Common use of Sub-Processing Clause in Contracts

Sub-Processing. (a) The Controller hereby authorizes the appointment and use of Sub-processor(s) engaged by the Processor for the provision of the Services. The Controller approves the Sub-processor(s) set out in Annex 5. (b) The Controller acknowledges and agrees that: (i) Wolters Kluwer group may be retained as Sub- processors; and (ii) the Processor and Wolters Kluwer group respectively may engage third-party Sub- processors (and permit each Sub-Processor appointed under this clause 5 to appoint sub-processors) in connection with the provision of the Services. (c) In case the Processor intends to engage new or additional Sub-processors, the Controller hereby provides general written authorization for the Processor to do so, provided that the Processor shall inform the Controller of any intended changes concerning the addition or replacement of any Sub-processor ("Sub-processor Notice") such notice to be provided though CCH OneClick or on the GDPR page at ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇.▇▇/softwaresupport/2015/home.asp (“Sub-processor List Website”). The Controller is responsible for visiting the Sub-processor List Website from time to time. If the Controller has a reasonable basis to object to the use of any such new or additional Sub-processor, the Controller shall notify the Processor promptly in writing within 14 days after receipt of the Sub-processor Notice. In the event the Controller objects to a new or additional Sub-processor, and that objection is not unreasonable, the Processor will use reasonable efforts to make available to the Controller a change in the S ervices or recommend a commercially reasonable change to the Controller’s configuration or use of the Services to avoid Processing of Personal Data by the objected-to new or additional Sub-processor without unreasonably burdening the Controller. If the Processor is unable to make available such change within a reasonable period of time, which shall not exceed ninety (90) days, the Controller may terminate (notwithstanding any contrary provision in the Services Agreement and without liability to the Controller) the affected part of the Services Agreement with respect only to those Services which cannot be provided by the Processor without the use of the objected-to new or additional Sub-processor by providing written notice to the Processor. (d) The Processor and/or Wolters Kluwer group shall impose the same data protection obligations as set out in this DPA on any Sub-processor by contract. The contract between the Processor and the Sub- processor shall in particular provide sufficient guarantees to implement the Technical and Organizational Security Measures as specified in Annex 4, to the extent such Technical and Organizational Security Measures are relevant for the services provided by the Sub-processor. The Controller agrees that in respect of transfers of Personal Data under this DPA from the EU, the European Economic Area (“EEA”) and/or their Member States and Switzerland to Third Countries, to the extent such transfers are subject to the Applicable Data Protection Law, the Processor shall secure the transfer under the EU- US Privacy Shield pursuant to Decision 2016/1250/EU (“Privacy Shield”), the terms of the Standard Contractual Clauses for the Transfer of Personal Data to Processors Established in Third Countries pursuant to Decision 2010/87/EU (“Model Clauses”) or such other mechanism approved by the European Commission and valid from time to time. (e) The Processor and/or Wolters Kluwer group shall choose the Sub-processor(s) diligently. (f) The Processor shall remain liable to the Controller for the performance of the Sub-processor’s obligations, should the Sub-processor fail to fulfil its obligations. However, the Processor shall not be liable for damages and claims that ensue from the Controller’s instructions to Sub-processors. (g) The provisions of this clause 5 shall not apply to the extent Controller instructs the Processor to allow a third party to Process Controller’s Personal Data pursuant to a contract that Controller has directly with the third party.

Sub-Processing. (a) The Controller hereby authorizes the appointment and use of Sub-processor(s) engaged by the Processor for the provision of the Services. The Controller approves the Sub-processor(s) set out in Annex 5. (b) The Controller acknowledges and agrees that: (i) Wolters Kluwer group Group may be retained as Sub- processors; and (ii) the Processor and Wolters Kluwer group Group respectively may engage third-party Sub- processors (and permit each Sub-Processor appointed under this clause 5 to appoint sub-processors) in connection with the provision of the Services. (c) In case the Processor intends to engage new or additional Sub-processors, the Controller hereby provides general written authorization for the Processor to do so, provided that the Processor shall inform the Controller of any intended changes concerning the addition or replacement of any Sub-processor ("Sub-processor Notice") such notice to be provided though CCH OneClick through Finsit or on the GDPR page at ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇.▇▇/softwaresupport/2015/home.asp or any dedicated websites of Processor from time to time (“Sub-processor List Website”). The Controller is responsible for visiting the Sub-processor List Website from time to time. If the Controller has a reasonable basis to object to the use of any such new or additional Sub-processor, the Controller shall notify the Processor promptly in writing within 14 days after receipt publication of the Sub-processor Notice. In the event the Controller objects to a new or additional Sub-processor, and that objection is not unreasonable, the Processor will use reasonable efforts to make available to the Controller a change in the S ervices Services or recommend a commercially reasonable change to the Controller’s configuration or use of the Services to avoid Processing of Personal Data by the objected-to new or additional Sub-processor without unreasonably burdening the Controller. If the Processor is unable to make available such change within a reasonable period of time, which shall not exceed ninety (90) days, the Controller may terminate (notwithstanding any contrary provision in the Services Agreement and without liability to the Controller) the affected part of the Services Agreement with respect only to those Services which cannot be provided by the Processor without the use of the objected-to new or additional Sub-processor by providing written notice to the Processor. (d) The Processor and/or Wolters Kluwer group Group shall impose the same data protection obligations as set out in this DPA on any Sub-processor by contract. The contract between the Processor and the Sub- processor shall in particular provide sufficient guarantees to implement the Technical and Organizational Security Measures as specified in Annex 4, to the extent such Technical and Organizational Security Measures are relevant for the services provided by the Sub-processor. The Controller agrees that in respect of transfers of Personal Data under this DPA from the UK, EU, the European Economic Area (“EEA”) and/or their Member States and Switzerland to Third Countries, to the extent such transfers are subject to the Applicable Data Protection Law, the Processor shall secure the transfer under the EU- US Privacy Shield pursuant to Decision 2016/1250/EU (“Privacy Shield”), the terms of the Standard Contractual Clauses for the Transfer of Personal Data to Processors Established in Third Countries pursuant to Decision 2010/87/EU (“Model Clauses”) or such other mechanism approved by the UK or European Commission (as applicable) and valid from time to time. (e) The Processor and/or Wolters Kluwer group Group shall choose the Sub-processor(s) diligently. (f) The Processor shall remain liable to the Controller for the performance of the Sub-processor’s obligations, should the Sub-processor fail to fulfil its obligations. However, the Processor shall not be liable for damages and claims that ensue from the Controller’s instructions to Sub-processors. (g) The provisions of this clause 5 shall not apply to the extent Controller instructs the Processor to allow a third party to Process Controller’s Personal Data pursuant to a contract that Controller has directly with the third party.

Sub-Processing. (a) The Controller hereby authorizes the appointment and use of Sub-processor(s) engaged by the Processor for the provision of the Services. The Controller approves the Sub-processor(s) set out in Annex 5. (b) The Controller acknowledges and agrees that: (i) Wolters Kluwer group may be retained as Sub- processors; and (ii) the Processor and Wolters Kluwer group respectively may engage third-party Sub- processors (and permit each Sub-Processor appointed under this clause 5 to appoint sub-processors) in connection with the provision of the Services. (c) In case the Processor intends to engage new or additional Sub-processors, the Controller hereby provides general written authorization for the Processor to do so, provided that the Processor shall inform the Controller of any intended changes concerning the addition or replacement of any Sub-processor ("Sub-processor Notice") such notice to be provided though CCH OneClick or on the GDPR page at ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇.▇▇/softwaresupport/2015/home.asp (“Sub-processor List Website”). The Controller is responsible for visiting the Sub-processor List Website from time to time. If the Controller has a reasonable basis to object to the use of any such new or additional Sub-processor, the Controller shall notify the Processor promptly in writing within 14 days after receipt of the Sub-processor Notice. In the event the Controller objects to a new or additional Sub-processor, and that objection is not unreasonable, the Processor will use reasonable efforts to make available to the Controller a change in the S ervices Services or recommend a commercially reasonable change to the Controller’s configuration or use of the Services to avoid Processing of Personal Data by the objected-to new or additional Sub-processor without unreasonably burdening the Controller. If the Processor is unable to make available such change within a reasonable period of time, which shall not exceed ninety (90) days, the Controller may terminate (notwithstanding any contrary provision in the Services Agreement and without liability to the Controller) the affected part of the Services Agreement with respect only to those Services which cannot be provided by the Processor without the use of the objected-to new or additional Sub-processor by providing written notice to the Processor. (d) The Processor and/or Wolters Kluwer group shall impose the same data protection obligations as set out in this DPA on any Sub-processor by contract. The contract between the Processor and the Sub- processor shall in particular provide sufficient guarantees to implement the Technical and Organizational Security Measures as specified in Annex 4, to the extent such Technical and Organizational Security Measures are relevant for the services provided by the Sub-processor. The Controller agrees that in respect of transfers of Personal Data under this DPA from the EU, the European Economic Area (“EEA”) and/or their Member States and Switzerland to Third Countries, to the extent such transfers are subject to the Applicable Data Protection Law, the Processor shall secure the transfer under the EU- US Privacy Shield pursuant to Decision 2016/1250/EU (“Privacy Shield”), the terms of the Standard Contractual Clauses for the Transfer of Personal Data to Processors Established in Third Countries pursuant to Decision 2010/87/EU (“Model Clauses”) or such other mechanism approved by the European Commission and valid from time to time. (e) The Processor and/or Wolters Kluwer group shall choose the Sub-processor(s) diligently. (f) The Processor shall remain liable to the Controller for the performance of the Sub-processor’s obligations, should the Sub-processor fail to fulfil its obligations. However, the Processor shall not be liable for damages and claims that ensue from the Controller’s instructions to Sub-processors. (g) The provisions of this clause 5 shall not apply to the extent Controller instructs the Processor to allow a third party to Process Controller’s Personal Data pursuant to a contract that Controller has directly with the third party.

Sub-Processing. (a) The Controller hereby authorizes the appointment and use of Sub-processor(s) engaged by the Processor for the provision of the Services. The Controller approves the Sub-processor(s) set out in Annex 5. (b) The Controller acknowledges and agrees that: (i) Wolters Kluwer group may be retained as Sub- processors; and (ii) the Processor and Wolters Kluwer group respectively may engage third-party Sub- processors (and permit each Sub-Processor appointed under this clause 5 to appoint sub-processors) in connection with the provision of the Services. (c) In case the Processor intends to engage new or additional Sub-processors, the Controller hereby provides general written authorization for the Processor to do so, provided that the Processor shall inform the Controller of any intended changes concerning the addition or replacement of any Sub-processor ("Sub-processor Notice") such notice to be provided though CCH OneClick or on the GDPR page at 2.1 Customer generally authorises ▇▇▇▇▇://▇ to appoint Sub-Processors in accordance with this Paragraph 2. 2.2 Pryon may continue to use those Sub-Processors already engaged by ▇▇▇.▇▇▇.▇▇.▇▇/softwaresupport/2015/home.asp ▇ as at the date of this DPA (as those Sub-Processors are shown, together with their respective functions and locations, in Annex 4 (Authorised Sub-Processors) (the “Sub-processor List WebsiteProcessor List”). The Controller is responsible for visiting . 2.3 Pryon shall give Customer prior written notice of the appointment of any proposed Sub-Processor, including reasonable details of the Processing to be undertaken by the Sub-processor List Website from time to time. If the Controller has a reasonable basis to object to the use of any such new or additional Sub-processorProcessor, the Controller shall notify the Processor promptly in writing within 14 days after receipt [by providing Customer with an updated copy of the Sub-processor NoticeProcessor List via a ‘mailshot’ or similar bulk distribution mechanism sent via email to Customer’s contact point as set out in Attachment 1 to Annex 1 (European Annex)]. In If, within [fourteen (14)] days of receipt of that notice, Customer notifies Pryon in writing of any objections (on reasonable grounds) to the event the Controller objects to a new or additional Sub-processor, and that objection is not unreasonable, the Processor will proposed appointment: (a) Pryon shall use reasonable efforts to make available to the Controller a change in the S ervices or recommend a commercially reasonable change to in the Controller’s configuration or provision of the Services, which avoids the use of the Services to avoid Processing of Personal Data by the objected-to new or additional that proposed Sub-processor without unreasonably burdening the Controller. If the Processor is unable to make available Processor; and (b) where: (i) such a change within a reasonable period of time, which shall not exceed ninety (90) days, the Controller may terminate (notwithstanding any contrary provision in the Services Agreement and without liability to the Controller) the affected part of the Services Agreement with respect only to those Services which cannot be provided made within fourteen (14) days from ▇▇▇▇▇’s receipt of Customer’s notice; (ii) no commercially reasonable change is available; and/or (iii) Customer declines to bear the cost of the proposed change, then either Party may by written notice to the Processor without other Party with immediate effect terminate the Agreement, either in whole or to the extent that it relates to the Services which require the use of the objected-to new or additional proposed Sub-processor by providing written notice Processor, as its sole and exclusive remedy. 2.4 If Customer does not object to ▇▇▇▇▇’s appointment of a Sub-Processor during the objection period referred to in Paragraph 2.3, Customer shall be deemed to have approved the engagement and ongoing use of that Sub-Processor. (d) The 2.5 With respect to each Sub-Processor, Pryon shall maintain a written contract between Pryon and the Sub-Processor and/or Wolters Kluwer group shall impose the same data that includes terms which offer at least an equivalent level of protection obligations for Customer Personal Data as those set out in this DPA on any Sub-processor by contract(including the Security Measures). The contract between the Processor and the Sub- processor shall in particular provide sufficient guarantees to implement the Technical and Organizational Security Measures as specified in Annex 4, to the extent such Technical and Organizational Security Measures are relevant for the services provided by the Sub-processor. The Controller agrees that in respect of transfers of Personal Data under this DPA from the EU, the European Economic Area (“EEA”) and/or their Member States and Switzerland to Third Countries, to the extent such transfers are subject to the Applicable Data Protection Law, the Processor shall secure the transfer under the EU- US Privacy Shield pursuant to Decision 2016/1250/EU (“Privacy Shield”), the terms of the Standard Contractual Clauses for the Transfer of Personal Data to Processors Established in Third Countries pursuant to Decision 2010/87/EU (“Model Clauses”) or such other mechanism approved by the European Commission and valid from time to time. (e) The Processor and/or Wolters Kluwer group shall choose the Sub-processor(s) diligently. (f) The Processor Pryon shall remain liable to the Controller for the performance any breach of the this DPA caused by a Sub-processor’s obligations, should the Sub-processor fail to fulfil its obligations. However, the Processor shall not be liable for damages and claims that ensue from the Controller’s instructions to Sub-processorsProcessor. (g) The provisions of this clause 5 shall not apply to the extent Controller instructs the Processor to allow a third party to Process Controller’s Personal Data pursuant to a contract that Controller has directly with the third party.

Sub-Processing. (a) a. The Data Controller hereby authorizes authorises the appointment and use of Sub-processor(s) engaged by the Data Processor for the provision of the Services. The Controller approves to appoint the Sub-processor(s) set out in Annex 5. (b) The Controller acknowledges and agrees that: (i) Wolters Kluwer group may be retained as Sub- processors; and (ii) processors listed at the Processor and Wolters Kluwer group respectively may engage third-party Sub- processors (and permit each Sub-Processor appointed under this clause 5 to appoint sub-processors) in connection with the provision of the Services. (c) In case the Processor intends to engage new or additional Sub-processors, the Controller hereby provides general written authorization for the Processor to do so, provided that the Processor shall inform the Controller of any intended changes concerning the addition or replacement of any Sub-processor ("Sub-processor Notice") such notice to be provided though CCH OneClick or on the GDPR page at link ▇▇▇▇▇://▇▇▇.▇▇▇▇▇.▇▇▇/legal/. b. Subject to Section 5.1, the Data Processor shall provide reasonable notice to the Data Controller before engaging a new Sub-processor by means of email to the address provided in the Subscriber Agreement indicating to the Data Controller that it has updated the list of Sub-processors set forth at the link ▇▇▇▇▇://▇▇▇▇▇▇▇▇.▇▇/softwaresupport/2015/home.asp (“Sub-processor List Website”). The ▇/legal/.The Data Controller is responsible for visiting the Sub-processor List Website from time to time. If the Controller has a reasonable basis to may object to such changes within thirty (30) calendar days of receipt of the use notice, if there is a justified reason. In the event that the Data Controller objects to the appointment of any such a new or additional Sub-processor, the Controller Data Processor shall notify the Processor promptly in writing within 14 days after receipt of the Sub-processor Notice. In the event the Controller objects to a new or additional Sub-processor, and that objection is not unreasonable, the Processor will use reasonable efforts be entitled to make available to the Controller a change in the S ervices or recommend a commercially reasonable change to the Controller’s configuration or use of Services that avoids the Services to avoid Processing processing of Personal Data by the objected-to new or additional Sub-processor without unreasonably burdening in favour of the Data Controller. If the Data Processor is unable to make available such change available within a reasonable period of timeperiod, which shall not exceed ninety (90) daysit will notify the Data Controller. In such case, the Data Controller may terminate (notwithstanding any contrary provision the Main Agreement upon written notice sent by registered e-mail or registered letter with acknowledgment of receipt. c. The Data Processor shall, in relation to each Sub-processor: i. provide the Services Agreement and without liability to Data Controller with information about the Controller) the affected part of the Services Agreement data processing operations that shall be carried out by each Sub-processor; ii. conduct adequate due diligence procedures with respect only to those Services which cannot be provided by the Processor without the use of the objected-to new or additional each Sub-processor for the purpose of ensuring that the latter is able to provide the level of protection for Personal Data required by this DPA, including, without limitation, providing written notice to sufficient guarantees that adequate technical and organisational measures will be implemented so that data processing operations comply with any requirements under the Processor.Data Protection Legislation and this DPA; (d) The iii. include in the agreement executed by the Data Processor and/or Wolters Kluwer group shall impose the same data protection obligations as set out in this DPA on any and each Sub-processor by contract. The contract between terms and conditions that substantially restate the Processor and the Sub- processor shall in particular provide sufficient guarantees to implement the Technical and Organizational Security Measures same as those specified in Annex 4, this DPA; iv. to the extent such Technical the agreement between the Data Processor and Organizational Security Measures are relevant each Sub-Processor provides for the services provided by the Sub-processor. The Controller agrees that in respect of transfers transfer of Personal Data under this DPA from outside the EUEEA, the European Economic Area (“EEA”) and/or their Member States and Switzerland to Third Countries, to the extent such transfers are subject to the Applicable Data Protection Law, the Processor shall secure the transfer under the EU- US Privacy Shield pursuant to Decision 2016/1250/EU (“Privacy Shield”), the terms of include the Standard Contractual Clauses for the Transfer of Personal Data to Processors Established in Third Countries or any other tool pursuant to Decision 2010/87/EU (“Model Clauses”) or such other mechanism approved by the European Commission and valid from time to time. (e) The Processor and/or Wolters Kluwer group shall choose the Sub-processor(s) diligently. (f) The Processor shall remain liable to the Controller for the performance of the Sub-processor’s obligations, should the Data Protection Legislation in any agreement with each Sub-processor fail in order to fulfil its obligations. However, provide adequate protection to the Processor shall not processing of Personal Data; and v. be fully liable towards the Data Controller for damages and claims that ensue from the Controller’s instructions to any breach committed by each Sub-processorsprocessor in relation to its obligations concerning the processing of Personal Data. (g) The provisions of this clause 5 shall not apply to the extent Controller instructs the Processor to allow a third party to Process Controller’s Personal Data pursuant to a contract that Controller has directly with the third party.

Sub-Processing. (a) The Processor shall not subcontract its obligations under this Addendum or under the Service Contract to a sub-processor without the prior written consent of Controller. Processor shall inform Controller hereby authorizes of its intention to engage a sub-processor and Controller shall have the right to consent to the appointment and use of Suba new sub-processor(s) engaged by processor, which consent shall not be unreasonably withheld, conditioned or delayed. If Controller agrees to the Processor for appointment of sub-processors, those sub‑processors must be appointed on the provision of the Services. The Controller approves the Sub-processor(s) substantially similar terms as are set out in Annex 5. this Addendum with respect to the protection of Customer Data to the extent applicable to the nature of the services provided by such sub-processor. Controller hereby approves the appointment of the following third-party sub-processors: Amazon Web Services (bto the extent that the Controller has purchased a cloud hosted solution) The as its web hosting provider (and All Lines Technology in the U.S. to the extent the Controller has purchased the Emerald support package) by Processor as a sub-processer. Controller acknowledges and agrees that: (i) Wolters Kluwer group may that Affiliates of Panopto EMEA Limited will be retained as Sub- processors; and (ii) the Processor and Wolters Kluwer group respectively may engage third-party Sub- processors (and permit each Sub-Processor appointed under this clause 5 to appoint sub-processors. Except as otherwise set forth in the Services Contract, Processor shall be liable for the act and omission of its sub-processors to the same extent Processor would be liable if performing the services of each sub-processor directly under this Addendum. Processor may, by giving no less than thirty (30) days’ notice to Controller, as or make changes to the list of sub- processors. Controller may object to the appointment of an additional sub-processor within fourteen (14) days of such notice on reasonable grounds relating to the protection of Personal Data, in connection with which case Processor shall have the provision right to cure the objection through one of the Services. following options (to be selected at Processor’s sole discretion): (a) Processor will cancel its plans to use such sub-processor with regard to Personal Data or will offer an alternative to provide its services without such sub-processor; (b) Processor will take the corrective steps requested by Controller in its objections (which remove Controller’s objection) and proceed to use the sub-processor with regard to the Personal Data; or (c) In case Processor may cease to provide or Controller may agree not to use (temporarily or permanently) the Processor intends particular aspect of the services that would involve the use of such sub-processor with regard to engage new or additional Sub-processorsPersonal Data, subject to a mutual agreement of the Controller hereby provides general written authorization parties to adjust the remuneration for the services provided considering the reduced scope of the services to the extent possible. If note on the above options are reasonably available and the objection has not been resolved to the mutual satisfaction of the parties within 30 days after Processor’s receipt of Controller’s objection, either party may terminate the Agreement and Controller will be entitled to a pro-rata refund for the prepaid fees for the services not performed as of the date of termination. Notwithstanding the foregoing, Processor may replace a sub-processor if the need for the change is urgent and necessary to do so, provided that provide the Processor’s services and the reason for the change is beyond the Processors control in which case Processor shall inform the notify Controller of any intended changes concerning such replacement as soon as reasonably practicable and Controller shall retain the addition or replacement of any Sub-processor ("Sub-processor Notice") such notice to be provided though CCH OneClick or on the GDPR page at ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇.▇▇/softwaresupport/2015/home.asp (“Sub-processor List Website”). The Controller is responsible for visiting the Sub-processor List Website from time to time. If the Controller has a reasonable basis right to object to the use of any such new or additional Sub-processor, the Controller shall notify the Processor promptly in writing within 14 days after receipt of the Subreplacement sub-processor Notice. In the event the Controller objects to a new or additional Sub-processor, and that objection is not unreasonable, the Processor will use reasonable efforts to make available to the Controller a change in the S ervices or recommend a commercially reasonable change to the Controller’s configuration or use of the Services to avoid Processing of Personal Data by the objected-to new or additional Sub-processor without unreasonably burdening the Controller. If the Processor is unable to make available such change within a reasonable period of time, which shall not exceed ninety (90) days, the Controller may terminate (notwithstanding any contrary provision in the Services Agreement and without liability to the Controller) the affected part of the Services Agreement with respect only to those Services which cannot be provided by the Processor without the use of the objected-to new or additional Sub-processor by providing written notice to the Processor. (d) The Processor and/or Wolters Kluwer group shall impose the same data protection obligations as set out in this DPA on any Sub-processor by contract. The contract between the Processor and the Sub- processor shall in particular provide sufficient guarantees to implement the Technical and Organizational Security Measures as specified in Annex 4, to the extent such Technical and Organizational Security Measures are relevant for the services provided by the Sub-processor. The Controller agrees that in respect of transfers of Personal Data under this DPA from the EU, the European Economic Area (“EEA”) and/or their Member States and Switzerland to Third Countries, to the extent such transfers are subject to the Applicable Data Protection Law, the Processor shall secure the transfer under the EU- US Privacy Shield pursuant to Decision 2016/1250/EU (“Privacy Shield”), the terms of the Standard Contractual Clauses for the Transfer of Personal Data to Processors Established in Third Countries pursuant to Decision 2010/87/EU (“Model Clauses”) or such other mechanism approved by the European Commission and valid from time to timeforth above. (e) The Processor and/or Wolters Kluwer group shall choose the Sub-processor(s) diligently. (f) The Processor shall remain liable to the Controller for the performance of the Sub-processor’s obligations, should the Sub-processor fail to fulfil its obligations. However, the Processor shall not be liable for damages and claims that ensue from the Controller’s instructions to Sub-processors. (g) The provisions of this clause 5 shall not apply to the extent Controller instructs the Processor to allow a third party to Process Controller’s Personal Data pursuant to a contract that Controller has directly with the third party.

Sub-Processing. (a) The Controller hereby authorizes the appointment and use of 7.1. DT engages Sub-processor(s) engaged by the Processor for the provision Processors to perform certain Processing of the ServicesSupply Partner Personal Data on Supply Partner’s behalf. The Controller approves the Prior to an engagement with a Sub-processor(s) set out in Annex 5. (b) The Controller acknowledges and agrees thatProcessor, DT: (i) Wolters Kluwer group may be retained Carries out reviews and requires or receives adequate assurances that the Sub-Processor complies with obligations substantially similar to the obligations as Sub- processorsset out in this Addendum; and (ii) ensures that a Statutory Data Transfer Agreement or such other appropriate methods of Personal Data transfer are at all relevant times incorporated into the Processor agreement executed between DT and Wolters Kluwer group respectively may engage thirdthe Sub-party Sub- processors (and permit each Processor, if the engagement with the Sub-Processor appointed under this clause 5 to appoint sub-processors) in connection with the provision involves a Personal Data Transfer of the ServicesSupply Partner Personal Data,. (c) In case 7.2. Upon the Processor intends execution of this Addendum, Supply Partner hereby gives DT Supply Partner’s approval to engage new or additional Sub-processors, the Controller hereby provides general written authorization for the Processor to do so, provided that the Processor shall inform the Controller of any intended changes concerning the addition or replacement of any Sub-processor ("Sub-processor Notice") such notice to be provided though CCH OneClick or on the GDPR page companies detailed at ▇▇▇▇▇://▇▇▇.▇▇▇▇▇▇▇▇▇▇▇.▇▇.▇▇/softwaresupport/2015/legal/home.asp (“sub- processor-list-for-dtx as Sub-processor List Website”)Processors. 7.3. The Controller is responsible for visiting the Where a Sub-processor List Website from time Processor fails to time. If the Controller has a reasonable basis to object to the use of any such new or additional Sub-processor, the Controller shall notify the Processor promptly in writing within 14 days after receipt of the Sub-processor Notice. In the event the Controller objects to a new or additional Sub-processor, and that objection is not unreasonable, the Processor will use reasonable efforts to make available to the Controller a change in the S ervices or recommend a commercially reasonable change to the Controller’s configuration or use of the Services to avoid Processing of Personal Data by the objected-to new or additional Sub-processor without unreasonably burdening the Controller. If the Processor is unable to make available such change within a reasonable period of time, which shall not exceed ninety (90) days, the Controller may terminate (notwithstanding any contrary provision in the Services Agreement and without liability to the Controller) the affected part of the Services Agreement with respect only to those Services which cannot be provided by the Processor without the use of the objected-to new or additional Sub-processor by providing written notice to the Processor. (d) The Processor and/or Wolters Kluwer group shall impose the same fulfill its data protection obligations as set out in this DPA on any Sub-processor by contract. The contract between the Processor and the Sub- processor shall in particular provide sufficient guarantees to implement the Technical and Organizational Security Measures as specified in Annex 4or statements, to the extent such Technical and Organizational Security Measures are relevant for the services provided by the Sub-processor. The Controller agrees that in respect of transfers of Personal Data under this DPA from the EU, the European Economic Area (“EEA”) and/or their Member States and Switzerland to Third Countries, to the extent such transfers are subject to the Applicable Data Protection Law, the Processor shall secure the transfer under the EU- US Privacy Shield pursuant to Decision 2016/1250/EU (“Privacy Shield”), the terms of the Standard Contractual Clauses for the Transfer of Personal Data to Processors Established in Third Countries pursuant to Decision 2010/87/EU (“Model Clauses”) or such other mechanism approved by the European Commission and valid from time to time. (e) The Processor and/or Wolters Kluwer group shall choose the Sub-processor(s) diligently. (f) The Processor shall DT will remain fully liable to the Controller Supply Partner for the performance of the Sub-processor’s obligationsProcessor's obligations to the same extent that DT would be liable to Supply Partner directly under the terms of this Addendum, should except as otherwise set forth in the Agreement, if DT would have performed the obligations of the Sub-processor fail Processor. 7.4. DT will inform Supply Partner of DT’s engagement with a new Sub-Processor. Supply Partner may object to fulfil its obligationsthe use of new or additional Sub-Processor by sending DT a written notice within five (5) business days of receipt of said notice. HoweverIf Supply Partner objects to the new Sub-Processor, DT will make commercially reasonable efforts to provide Supply Partner the Processor shall same level of Service without the use of such Sub-Processor. Notwithstanding, Supply Partner’s objection and the results thereof will not amend, alter or reduce Supply Partner’s obligations under the Agreement. Supply Partner will not be liable for damages entitled to any refund and claims that ensue will hold DT harmless from and against any claims, suits and demands associated with or related to Supply Partner’s termination of the ControllerAgreement, in connection with Supply Partner’s instructions objection to a new Sub-Processor. 7.5. Notwithstanding the provisions here above (e.g. prior consent by Supply Partner), Supply Partner hereby authorizes DT to sub-contract the Processing to Sub-processors. (g) The provisions Processors based outside of this clause 5 shall not apply Supply Partner’s jurisdiction, to the extent Controller instructs necessary, at DT sole discretion, to duly perform the Processor Service on condition that the Sub-Processors provide sufficient guarantees in relation to allow required level of data protection, e.g. through a third party to Process Controller’s sub-contracting agreement which is based on a Statutory Data Protection Agreement , or based on such other applicable Personal Data pursuant Transfer mechanisms. Any such Statutory Data Protection Agreement concluded by DT will be treated as if concluded in the name and on behalf of Supply Partner. Supply Partner will be responsible to a contract that Controller has directly with obtain regulatory approvals from the third partyrelevant Supervising Authorities and to perform any submissions and registrations, as required by Data Protection Laws.

Sub-Processing. 13.1 ‘Sub-Processing’, in the meaning of this Agreement, does not include ancillary services, such as telecommunication services, postal / transport services, maintenance and user support services or the disposal of data carriers, as well as other measures to ensure the confidentiality, availability, integrity and resilience of the hardware and software of data Processing equipment. The Processor shall, however, be obliged to make appropriate and legally binding contractual arrangements and take appropriate inspection measures to ensure the data protection and the data security of the Controller's data, even in the case of outsourced ancillary services to Sub-Processors. 13.2 The Controller agrees to the commissioning of the following sub-processors on the condition of a contractual agreement in accordance with applicable data protection laws: Sub-Processor Address / country Service N/A N/A N/A 13.3 Outsourcing to further Sub-Processors or changing any existing Sub-Processors is permissible if the Processor informs the Controller of the identity of the Sub- Processor and the scope of the planned Sub-Processing in writing or in text form and the Controller does not object to the planned Sub-Processing in writing or in text form within ten (10) days as from giving notice by the Processor. The Controller shall not unreasonably object to the planned Sub-Processing. In addition, the following provisions apply: (a) The Controller hereby authorizes the appointment and use transfer of Sub-processor(s) engaged by the Processor for the provision of the Services. The Controller approves Personal Data to the Sub-processor(s) set out in Annex 5.Processor and the Sub-Processor’s commencement of the data Processing shall only be undertaken after compliance with all requirements has been achieved; (b) The Controller acknowledges and agrees that: (i) Wolters Kluwer group may be retained as Sub- processors; and (ii) if the Processor and Wolters Kluwer group respectively may engage third-party Sub- processors (and permit each Sub-Processor appointed under this clause 5 to appoint sub-processors) in connection provides the agreed service outside the EU/EEA, the Processor shall ensure compliance with the provision of the Services.Applicable Laws; and (c) In case the Processor intends to engage new or additional Sub-processors, the Controller hereby provides general written authorization for the Processor to do so, provided that the Processor shall inform the Controller of any intended changes concerning the addition or replacement of any Sub-processor ("Sub-processor Notice") such notice to be provided though CCH OneClick or impose on the GDPR page at ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇.▇▇/softwaresupport/2015/home.asp (“Sub-processor List Website”). The Controller is responsible for visiting the Sub-processor List Website from time to time. If the Controller has a reasonable basis to object to the use of any such new or additional Sub-processor, the Controller shall notify the Processor promptly in writing within 14 days after receipt of the Sub-processor Notice. In the event the Controller objects to a new or additional Sub-processor, and that objection is not unreasonable, the Processor will use reasonable efforts to make available to the Controller a change in the S ervices or recommend a commercially reasonable change to the Controller’s configuration or use of the Services to avoid Processing of Personal Data by the objected-to new or additional Sub-processor without unreasonably burdening the Controller. If the Processor is unable to make available such change within a reasonable period of time, which shall not exceed ninety (90) days, the Controller may terminate (notwithstanding any contrary provision in the Services Agreement and without liability to the Controller) the affected part of the Services Agreement with respect only to those Services which cannot be provided by the Processor without the use of the objected-to new or additional Sub-processor by providing written notice to the Processor. (d) The Processor and/or Wolters Kluwer group shall impose the same data protection obligations as set out in this DPA on any Agreement, in particular with regard to the provision of sufficient guarantees to implement appropriate technical and organisational measures in such a manner that the Processing will meet the requirements of the Applicable Law. 13.4 With respect to each Sub-processor Processor, the Processor will before the Sub- Processor first Processes any data of the Controller, carry out adequate due diligence to ensure that the Sub-Processor is capable of providing the level of protection for the Personal Data required by contract. The contract this Agreement and shall ensure that the agreement between the Processor and the Sub- processor shall in particular provide sufficient guarantees to implement relevant Sub-Processor, is governed by a written contract including terms which offer at least the Technical and Organizational Security Measures as specified in Annex 4, to the extent such Technical and Organizational Security Measures are relevant same level of protection for the services provided by Controller as those set out in this Agreement and meets the Sub-processor. The Controller agrees that in respect requirements of transfers of Personal Data under this DPA from the EU, the European Economic Area (“EEA”article 28(3) and/or their Member States and Switzerland to Third Countries, to the extent such transfers are subject to the Applicable Data Protection Law, the Processor shall secure the transfer under the EU- US Privacy Shield pursuant to Decision 2016/1250/EU (“Privacy Shield”), the terms of the Standard Contractual Clauses for the Transfer of Personal Data to Processors Established in Third Countries pursuant to Decision 2010/87/EU (“Model Clauses”) or such other mechanism approved by the European Commission and valid from time to timeGDPR. (e) The Processor and/or Wolters Kluwer group shall choose the Sub-processor(s) diligently. (f) The Processor shall remain liable to the Controller for the performance of the Sub-processor’s obligations, should the Sub-processor fail to fulfil its obligations. However, the Processor shall not be liable for damages and claims that ensue from the Controller’s instructions to Sub-processors. (g) The provisions of this clause 5 shall not apply to the extent Controller instructs the Processor to allow a third party to Process Controller’s Personal Data pursuant to a contract that Controller has directly with the third party.

Sub-Processing. (a) 6.1 The Controller hereby authorizes the appointment and use of Sub-processor(s) engaged by Processor to engage the Processor for the provision of the Services. The Controller approves the Sub-processor(s) set out entities listed in Annex 5Exhibit 2 as a sub- processor. (b) 6.2 The Controller acknowledges and agrees that: (i) Wolters Kluwer group may be retained as Sub- processors; and (ii) the Processor and Wolters Kluwer group respectively may engage third-party Sub- processors (and permit each Sub-Processor appointed under this clause 5 to appoint sub-processors) in connection with the provision of the Services. (c) In case the Processor intends to engage new or additional Sub-processors, the Controller hereby provides general written authorization for the Processor to do so, provided that the Processor shall inform the Controller of any intended changes concerning the addition or replacement of any Subother processors or sub-processor processors ("Sub-processor Notice") such notice to be provided though CCH OneClick or on the GDPR page at ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇.▇▇/softwaresupport/2015/home.asp (hereinafter collectively “Sub-processor List WebsiteProcessors”). The , thereby giving the Controller is responsible for visiting the Sub-processor List Website from time opportunity to timeobject to and prohibit such changes. If the Controller has a reasonable basis to does not object to the use of any such new or additional Sub-processorwithin two weeks, the Controller addition or replacement shall notify the Processor promptly in writing within 14 days after receipt of the Sub-processor Notice. In the event the Controller objects be deemed to a new or additional Sub-processor, and that have been approved. 6.3 If an objection is not unreasonableraised in accordance with Section 6.2, the Processor will use reasonable efforts shall be entitled to make available terminate the Agreement as well as this DPA at any time, subject to giving two weeks’ prior notice. 6.4 Where the Controller a change in the S ervices or recommend a commercially reasonable change to Processor engages another Sub-Processor for carrying out specific processing activities on behalf of the Controller’s configuration or use of the Services to avoid Processing of Personal Data by the objected-to new or additional Sub-processor without unreasonably burdening the Controller. If the Processor is unable to make available such change within a reasonable period of time, which shall not exceed ninety (90) days, the Controller may terminate (notwithstanding any contrary provision in the Services Agreement and without liability to the Controller) the affected part of the Services Agreement with respect only to those Services which cannot be provided by the Processor without the use of the objected-to new or additional Sub-processor by providing written notice to the Processor. (d) The Processor and/or Wolters Kluwer group shall impose the same data protection obligations as set out in this DPA shall be imposed on any that Sub-processor Processor by means of a contract. The This contract between the Processor and the Sub- processor shall in particular provide sufficient guarantees to implement the Technical and Organizational Security Measures as specified in Annex 4, to the extent such Technical and Organizational Security Measures are relevant for the services provided by the Sub-processor. The Controller agrees Processor to implement appropriate technical and organizational measures in such a manner that the processing will meet the requirements of applicable data protection law. 6.5 Subject to the limitations of liability set out in respect of transfers of Personal Data under this DPA from the EUAgreement, where a Sub-Processor fails to fulfil its data protection obligations, the European Economic Area (“EEA”) and/or their Member States and Switzerland to Third Countries, to the extent such transfers are subject to the Applicable Data Protection Law, the Processor shall secure the transfer under the EU- US Privacy Shield pursuant to Decision 2016/1250/EU (“Privacy Shield”), the terms of the Standard Contractual Clauses for the Transfer of Personal Data to Processors Established in Third Countries pursuant to Decision 2010/87/EU (“Model Clauses”) or such other mechanism approved by the European Commission and valid from time to time. (e) The Processor and/or Wolters Kluwer group shall choose the Sub-processor(s) diligently. (f) The Processor shall remain liable to the Controller for the performance of the that Sub-processorProcessor’s obligations. 6.6 Notwithstanding Section 5, should where a. the Processor informs the Controller of the use of any Sub-processor fail to fulfil its obligations. However, Processors and includes or makes available upon request information on the Processor shall not be liable for damages and claims that ensue from the Controller’s instructions to contractual terms offered by such Sub-processors.Processors, including the technical and organizational measures implemented by such Sub-Processors (“Sub- (g) The provisions b. the Controller approves or is deemed to have approved such Sub-Processors pursuant to Sections 6.1 or 6.2, these Sub-Processing Terms shall be considered to be in full compliance with the terms of this clause DPA, including Sections 5 shall not apply to the extent Controller instructs the Processor to allow a third party to Process Controller’s Personal Data pursuant to a contract that Controller has directly with the third partyand 6.

Sub-Processing. (a) 8.1 The Controller hereby authorizes Processor is authorised to use sub-processors without further written permission from the appointment and use Controller. An updated list of the Processor´s Sub-processor(s) engaged by the Processor for the provision of the Services. The Controller approves the Sub-processor(s) set out in Annex 5. (b) The Controller acknowledges and agrees that: (i) Wolters Kluwer group may processors can be retained as Sub- processors; and (ii) the Processor and Wolters Kluwer group respectively may engage third-party Sub- processors (and permit each Sub-Processor appointed under this clause 5 to appoint sub-processors) in connection with the provision of the Services. (c) In case the Processor intends to engage new or additional Sub-processors, the Controller hereby provides general written authorization for the Processor to do so, provided that the Processor shall inform the Controller of any intended changes concerning the addition or replacement of any Sub-processor ("Sub-processor Notice") such notice to be provided though CCH OneClick or on the GDPR page found at ▇▇▇▇▇://h ttps://▇▇▇.▇▇▇.▇▇▇▇▇.▇▇/softwaresupport/2015/home.asp (“Sub▇/subprocessors. The Processor shall notify the Controller in writing of the identity of new sub-processors before entering into an agreement with the respective sub-processors, allowing the Controller to reasonably object to the appointment of the sub-processor List Website”)in question within 2 weeks after having received notice. 8.2 With respect to Forecast’s other sub-processors, Forecast will endeavor to give notice thirty (30) business days prior to any planned major additions or replacements, but will give notice no less than ten (10) business days prior to any such change. The Controller is responsible for visiting Clauses on business related issues that do not affect the Sublegal data protection content of the sub-processor List Website from time agreement, shall not require submission to the Controller. 8.3 Having received notice, the Controller has the right to make objections in writing and on reasonable grounds to the appointment of the new sub-processor within ten (10) business days. If no objection has been raised within this time, the Processor will deem the Controller to have authorized the new sub-processor. If the Controller has a reasonable basis refuses to object consent to the use Processors´ appointment of any such new or additional Suba sub-processorprocessors on reasonable grounds, the Controller shall notify the Processor promptly in writing within 14 days after receipt of the Sub-processor Notice. In the event the Controller objects to a new or additional Sub-processor, and that objection is not unreasonable, then the Processor will use reasonable efforts either look for alternative solutions or not appoint the sub-processor. In case of disagreement between the Parties concerning the appointment, then either party has the right to make available suspend or terminate this Agreement (and any other agreement between the Parties relating to the Controller a change in the S ervices or recommend a commercially reasonable change to the Controller’s configuration or use provision of the Services to avoid Processing of Personal Data services by the objected-to new or additional Sub-processor without unreasonably burdening the Controller. If the Processor is unable to make available such change within a reasonable period of time, which shall not exceed ninety (90) days, the Controller may terminate (notwithstanding any contrary provision in the Services Agreement and without liability to the Controller) without penalty for both parties. 8.4 Prior to letting the affected part of the Services Agreement with respect only to those Services which cannot be provided by the Processor without the use of the objected-to new or additional Subsub-processor by providing written notice to the Processor. (d) The Processor and/or Wolters Kluwer group shall impose the same data protection obligations as set out in this DPA on any Sub-processor by contract. The contract between the Processor and the Sub- processor shall in particular provide sufficient guarantees to implement the Technical and Organizational Security Measures as specified in Annex 4, to the extent such Technical and Organizational Security Measures are relevant for the services provided by the Sub-processor. The Controller agrees that in respect of transfers of Personal Data under this DPA from the EU, the European Economic Area (“EEA”) and/or their Member States and Switzerland to Third Countries, to the extent such transfers are subject to the Applicable Data Protection Lawcommence processing personal data, the Processor shall secure enter into a written agreement with the transfer sub-processor, making the sub-processor subject as a minimum to the obligations which the Processor is subject to under the EU- US Privacy Shield pursuant DPA, including the obligation to Decision 2016/1250/EU (“Privacy Shield”), implement adequate technical and organisational measures to ensure that the terms requirements of the Standard Contractual Clauses for the Transfer of Personal General Data to Processors Established in Third Countries pursuant to Decision 2010/87/EU (“Model Clauses”) or such other mechanism approved by the European Commission and valid from time to timeProtection Regulation be satisfied. (e) The Processor and/or Wolters Kluwer group shall choose the Sub-processor(s) diligently. (f) The Processor shall remain liable to the Controller for the performance of the Sub-processor’s obligations, should the Sub-processor fail to fulfil its obligations. However, the Processor shall not be liable for damages and claims that ensue from the Controller’s instructions to Sub-processors. (g) The provisions of this clause 5 shall not apply to the extent Controller instructs the Processor to allow a third party to Process Controller’s Personal Data pursuant to a contract that Controller has directly with the third party.

Sub-Processing. ‌ 2.1 Client generally authorises Inselligence to appoint Sub-Processors in accordance with this Paragraph 2. 2.2 Inselligence may continue to use those Sub-Processors already engaged by Inselligence as at the date of this DPA (as those Sub-Processors are shown, together with their respective functions and locations, in Annex 3 (Authorised Sub-Processors) (the “Sub-Processor List”). 2.3 Inselligence shall give Client prior written notice of the appointment of any proposed Sub-Processor, including reasonable details of the Processing to be undertaken by the Sub-Processor. If, within fourteen (14) days of receipt of that notice, Client notifies Inselligence in writing of any objections (on reasonable grounds) to the proposed appointment:‌ (a) The Controller hereby authorizes the appointment and use of Sub-processor(s) engaged by the Processor for the provision of the Services. The Controller approves the Sub-processor(s) set out in Annex 5. (b) The Controller acknowledges and agrees that: (i) Wolters Kluwer group may be retained as Sub- processors; and (ii) the Processor and Wolters Kluwer group respectively may engage third-party Sub- processors (and permit each Sub-Processor appointed under this clause 5 to appoint sub-processors) in connection with the provision of the Services. (c) In case the Processor intends to engage new or additional Sub-processors, the Controller hereby provides general written authorization for the Processor to do so, provided that the Processor Inselligence shall inform the Controller of any intended changes concerning the addition or replacement of any Sub-processor ("Sub-processor Notice") such notice to be provided though CCH OneClick or on the GDPR page at ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇.▇▇/softwaresupport/2015/home.asp (“Sub-processor List Website”). The Controller is responsible for visiting the Sub-processor List Website from time to time. If the Controller has a reasonable basis to object to the use of any such new or additional Sub-processor, the Controller shall notify the Processor promptly in writing within 14 days after receipt of the Sub-processor Notice. In the event the Controller objects to a new or additional Sub-processor, and that objection is not unreasonable, the Processor will use reasonable efforts to make available to the Controller a change in the S ervices or recommend a commercially reasonable change to in the Controller’s configuration or provision of the Services, which avoids the use of the Services to avoid Processing of Personal Data by the objected-to new or additional that proposed Sub-processor without unreasonably burdening the Controller. If the Processor is unable to make available Processor; and (b) where: (i) such a change within a reasonable period of time, which shall not exceed ninety (90) days, the Controller may terminate (notwithstanding any contrary provision in the Services Agreement and without liability to the Controller) the affected part of the Services Agreement with respect only to those Services which cannot be provided made within fourteen (14) days from Inselligence’s receipt of Client’s notice; (ii) no commercially reasonable change is available; and/or (iii) Client declines to bear the cost of the proposed change, then either Party may by written notice to the Processor without other Party with immediate effect terminate the Agreement, either in whole or to the extent that it relates to the Services which require the use of the objected-to new or additional proposed Sub-processor by providing written notice Processor, as its sole and exclusive remedy. 2.4 If Client does not object to Inselligence’s appointment of a Sub-Processor during the objection period referred to in Paragraph 2.3, Client shall be deemed to have approved the engagement and ongoing use of that Sub-Processor. (d) The 2.5 With respect to each Sub-Processor, Inselligence shall maintain a written contract between Inselligence and the Sub-Processor and/or Wolters Kluwer group shall impose the same data that includes terms which offer at least an equivalent level of protection obligations for Client Personal Data as those set out in this DPA on any Sub-processor by contract(including the Security Measures). The contract between the Processor and the Sub- processor shall in particular provide sufficient guarantees to implement the Technical and Organizational Security Measures as specified in Annex 4, to the extent such Technical and Organizational Security Measures are relevant for the services provided by the Sub-processor. The Controller agrees that in respect of transfers of Personal Data under this DPA from the EU, the European Economic Area (“EEA”) and/or their Member States and Switzerland to Third Countries, to the extent such transfers are subject to the Applicable Data Protection Law, the Processor shall secure the transfer under the EU- US Privacy Shield pursuant to Decision 2016/1250/EU (“Privacy Shield”), the terms of the Standard Contractual Clauses for the Transfer of Personal Data to Processors Established in Third Countries pursuant to Decision 2010/87/EU (“Model Clauses”) or such other mechanism approved by the European Commission and valid from time to time. (e) The Processor and/or Wolters Kluwer group shall choose the Sub-processor(s) diligently. (f) The Processor Inselligence shall remain liable to the Controller for the performance any breach of the this DPA caused by a Sub-processor’s obligations, should the Sub-processor fail to fulfil its obligations. However, the Processor shall not be liable for damages and claims that ensue from the Controller’s instructions to Sub-processorsProcessor. (g) The provisions of this clause 5 shall not apply to the extent Controller instructs the Processor to allow a third party to Process Controller’s Personal Data pursuant to a contract that Controller has directly with the third party.

Sub-Processing. (a) 5.1. The Data Controller hereby authorizes the appointment and use of Data Processor to appoint Sub-processor(s) processors in accordance with this Paragraph 5. 5.2. The Data Processor may continue to use those Sub-processors already engaged by the Data Processor for the provision as of the Services. The Controller approves Addendum Effective Date, subject to the Sub-processor(s) Data Processor in each case as soon as reasonably practicable meeting the obligations set out in Annex 5Paragraph 5.4. (b) 5.3. The Data Processor shall give the Data Controller acknowledges and agrees that: (i) Wolters Kluwer group may be retained as Sub- processors; and (ii) the Processor and Wolters Kluwer group respectively may engage third-party Sub- processors (and permit each Sub-Processor appointed under this clause 5 to appoint sub-processors) in connection with the provision prior written notice of the Services. (c) In case the Processor intends to engage new or additional Sub-processors, the Controller hereby provides general written authorization for the Processor to do so, provided that the Processor shall inform the Controller appointment of any intended changes concerning the addition or replacement of any Sub-processor ("Sub-processor Notice") such notice to be provided though CCH OneClick or on the GDPR page at ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇.▇▇/softwaresupport/2015/home.asp (“Sub-processor List Website”). The Controller is responsible for visiting the Sub-processor List Website from time to time. If the Controller has a reasonable basis to object to the use of any such new or additional Sub-processor, including reasonable details of the Controller shall notify the Processor promptly in writing within 14 days after receipt of Processing to be undertaken by the Sub-processor Noticeprocessor. In the event the Controller objects to a new or additional Sub-processorIf, and within ten (10) Business Days of receipt of that objection is not unreasonablenotice, the Data Controller notifies the Data Processor will in writing of any objections (on reasonable grounds) to the proposed appointment: a. The Data Processor shall use reasonable efforts to make available to the Controller a change in the S ervices or recommend a commercially reasonable change to in the Controller’s configuration or use provision of the Services to avoid Processing which avoids the use of Personal Data by the objected-to new or additional that proposed Sub-processor without unreasonably burdening the Controller. If the Processor is unable to make available processor; and b. where: i. such a change within a reasonable period of time, which shall not exceed ninety (90) days, the Controller may terminate (notwithstanding any contrary provision in the Services Agreement and without liability to the Controller) the affected part of the Services Agreement with respect only to those Services which cannot be provided made within sixty (60) days from the Data Processor’s receipt of the Data Controller’s notice; ii. no commercially reasonable change is available; and/or iii. the Data Controller declines to bear the cost of the proposed change, notwithstanding anything in the Agreement, the Data Processor and/or the Data Controller may by written notice to the Processor without other Party with immediate effect terminate the Agreement either in whole or to the extent that it relates to the Services which require the use of the objectedproposed Sub- processor. 5.4. With respect to each Sub-to new or additional processor, the Data Processor shall: a. before the Sub-processor first Processes the Data Controller’s Personal Data (or, as soon as reasonably practicable, in accordance with Paragraph 5.2), carry out adequate due diligence to ensure that the Sub-processor is capable of providing the level of protection for the Data Controller’s Personal Data required by providing this DPA; and b. ensure that the arrangement between the Data Processor and the Sub-processor is governed by a written notice to contract including terms which: i. offer at least an equivalent level of protection for the Processor. (d) The Processor and/or Wolters Kluwer group shall impose the same data protection obligations Data Controller’s Personal Data as those set out in this DPA on any Sub-processor by contract(including, in particular, those set out in Engage BDR, LLC DATA PROTECTION ADDENDUM Page 4 of 26 Paragraph 4 above); and ii. The contract between meet the Processor and the Sub- processor shall in particular provide sufficient guarantees to implement the Technical and Organizational Security Measures as specified in Annex 4, to the extent such Technical and Organizational Security Measures are relevant for the services provided by the Sub-processor. The Controller agrees that in respect requirements of transfers of Personal Data under this DPA from the EU, the European Economic Area (“EEA”) and/or their Member States and Switzerland to Third Countries, to the extent such transfers are subject to the Applicable Data Protection LawLaws, the Processor shall secure the transfer under the EU- US Privacy Shield pursuant to Decision 2016/1250/EU (“Privacy Shield”)including, the terms but not limited to, Article 28(3) of the Standard Contractual Clauses for the Transfer of Personal Data to Processors Established in Third Countries pursuant to Decision 2010/87/EU (“Model Clauses”) or such other mechanism approved by the European Commission and valid from time to timeGDPR. (e) The Processor and/or Wolters Kluwer group shall choose the Sub-processor(s) diligently. (f) The Processor shall remain liable to the Controller for the performance of the Sub-processor’s obligations, should the Sub-processor fail to fulfil its obligations. However, the Processor shall not be liable for damages and claims that ensue from the Controller’s instructions to Sub-processors. (g) The provisions of this clause 5 shall not apply to the extent Controller instructs the Processor to allow a third party to Process Controller’s Personal Data pursuant to a contract that Controller has directly with the third party.

Sub-Processing. (ab) The Controller hereby authorizes controller gives permission for the appointment and use of Sub-processor(s) that are engaged in by the Processor for the provision of the Services. The Controller approves gives his approval for the Sub-Sub- processor(s) set out in Annex 5. (b) The Controller acknowledges and agrees that: (i) Wolters Kluwer group may be retained as Sub- processors; and (ii) specified on the website of Processor and Wolters Kluwer group respectively may engage third-party Sub- processors (and permit each Sub-Processor appointed under this clause 5 to appoint sub-processors) in connection with the provision of the Services. (c) In case the Processor intends to engage new or additional Sub-processors, the Controller hereby provides general written authorization for the Processor to do so, provided that the Processor shall inform the Controller of any intended changes concerning the addition or replacement of any Sub-processor ("Sub-processor NoticeProcessors") such notice to be provided though CCH OneClick or on the GDPR page at : ▇▇▇▇▇://▇▇▇.▇▇▇▇▇.▇▇.▇▇/softwaresupport/2015/home.asp /privacy-conditions/ (“c) In the event that the Processor intends to enable new or more Sub-processor List Website”). The Controller is responsible for visiting processors, the Processor shall ensure that the Sub-processor List Website from time to timeProcessor page on the website is updated. If Controller will be informed by Processor about changes in the Sub-Processor list on the website. lf the Controller has a reasonable basis grounds to object to the use of any such new or additional more Sub-processorprocessors, the Controller shall must immediately notify the Processor promptly this in writing within 14 days after of receipt of the Sub-Sub- processor NoticeNotification. In the event that the Controller objects to a new or additional Sub-different Sub- processor, and that objection is not unreasonable, the Processor will use make reasonable efforts to make changes to the Services available to the Controller a change in the S ervices Controller, or to recommend a commercially reasonable change to in the Controller’s configuration or use of the Services to avoid Controller or the use by the Controller of the Services, for the prevention of Processing of Personal Data by the objected-to new or additional other Sub-processor against whom has been objected, without unreasonably burdening the Controller. If the Processor is unable to cannot make this change available such change within a reasonable period of timeperiod, which period shall not exceed ninety sixty (9060) days, the Controller may terminate (notwithstanding any contrary provision in the Services Agreement and without liability to the Controller) the affected part of the Services Agreement with respect Agreement, however only to regarding those Services which that cannot be provided by the Processor without the use of the objected-to new or additional other Sub-processor objected to by providing means of written notice notification to the Processor. (d) The Processor and/or Wolters Kluwer group shall impose processor chooses the same data protection obligations as set out in this DPA on any Sub-processor by contract. The contract between with the necessary care. (e) lf such a Sub-processor is in a Third Country, at the written request of the Controller,the Processor and the Sub- processor shall in particular provide sufficient guarantees to implement the Technical and Organizational Security Measures as specified in Annex 4, to the extent such Technical and Organizational Security Measures are relevant will enter an EU model contract (Controller> Processor) for the services provided by Controller (in the Sub-processor. The Controller agrees that in respect name of transfers of Personal Data under this DPA from the EU, the European Economic Area (“EEA”) and/or their Member States and Switzerland to Third Countries, to the extent such transfers are subject to the Applicable Data Protection Law, the Processor shall secure the transfer under the EU- US Privacy Shield pursuant to Decision 2016/1250/EU (“Privacy Shield”Controller), the terms of the Standard Contractual Clauses for the Transfer of Personal Data to Processors Established in Third Countries pursuant to Decision 2010/87/EU (“Model Clauses”) or such other mechanism approved by EU. In this case, theController instructs and authorizes the European Commission and valid from time Processor to time. (e) The Processor and/or Wolters Kluwer group shall choose instruct the Sub-processor(s) diligentlyprocessors on behalf of the Controller, and to use all the rights of the Controller towards the Sub- processors based on the EU model contract. (f) The Without prejudice to the contents of clause 6 of the DPA, the Processor shall remain remains liable to the Controller for compliance with the performance obligations of the Sub-processor’s obligations, should processor if the Sub-processor fail to does not fulfil its obligations. However, the Processor shall is not be liable for damages damage and claims that ensue arising from instructions from the Controller’s instructions Controller to Sub-processors. (g) The provisions of this clause 5 shall not apply to the extent Controller instructs the Processor to allow a third party to Process Controller’s Personal Data pursuant to a contract that Controller has directly with the third party.

Sub-Processing. (a) The Controller 5.1 Customer hereby authorizes the appointment and use of Sub-processor(s) engaged by the Processor for the provision of the Services. The Controller approves the Sub-processor(s) set out in Annex 5. (b) The Controller acknowledges and agrees that: that Digital Realty may engage (i) Wolters Kluwer group may be retained Digital Reality affiliates as Sub- sub- processors; and (ii) the Processor and Wolters Kluwer group respectively may engage third-party Sub- processors (and permit each Sub-Processor appointed under this clause 5 to appoint sub-processors) in connection with the provision of the Services. (c) In case the Processor intends to engage new or additional Sub-processors, the Controller hereby provides general written authorization for the Processor to do so, provided that the Processor shall inform the Controller of any intended changes concerning the addition or replacement of any Sub-processor ("Sub-processor Notice") such notice to be provided though CCH OneClick or on the GDPR page processors set out at ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇▇▇▇▇▇▇▇▇.▇▇/softwaresupport/2015▇/about/home.asp (“legal/privacy/sub-processors. Customer acknowledges and agrees that the other party may engage third-party Sub-processors in connection with the provision of the Services. That other Party will enter into a written agreement with each Sub-processor List Website”). The Controller is responsible for visiting the Sub-processor List Website from time to time. If the Controller has a reasonable basis to object to the use of any such new or additional Sub-processor, the Controller shall notify the Processor promptly in writing within 14 days after receipt of the Sub-processor Notice. In the event the Controller objects to a new or additional Sub-processor, and that objection is not unreasonable, the Processor will use reasonable efforts to make available to the Controller a change in the S ervices or recommend a commercially reasonable change to the Controller’s configuration or use of the Services to avoid Processing of Personal Data by the objected-to new or additional Sub-processor without unreasonably burdening the Controller. If the Processor is unable to make available such change within a reasonable period of time, which shall not exceed ninety (90) days, the Controller may terminate (notwithstanding any contrary provision in the Services Agreement and without liability to the Controller) the affected part of the Services Agreement with respect only to those Services which cannot be provided by the Processor without the use of the objected-to new or additional Sub-processor by providing written notice to the Processor. (d) The Processor and/or Wolters Kluwer group shall impose the same containing data protection obligations that provide at least the same level of protection for Personal Data as set out those in this DPA on any Sub-processor by contract. The contract between the Processor and the Sub- processor shall in particular provide sufficient guarantees to implement the Technical and Organizational Security Measures as specified in Annex 4DPA, to the extent such Technical and Organizational Security Measures are relevant for applicable to the services nature of the Services provided by the such Sub-processor. 5.2 Customer hereby consents to this list of sub-processors, their locations, and processing activities as it pertains to its Personal Data. The Controller agrees that in respect Digital Realty shall: (A) make available an up-to-date list of transfers the sub-processors it has appointed upon written request from Customer; and (B) notify Customer if it adds any new sub-processors at least 14 days prior to allowing such sub-processor to process Customer Personal Data. Customer may request the current list of Personal Data under this DPA Sub- processors for the Services, including the identities of those Sub-processors and their country of location via email from ▇▇▇▇▇▇▇@▇▇▇▇▇▇▇▇▇▇▇▇▇.▇▇▇. Customer will have 14 days from the EUdate of receipt of the notice to approve or reject the change. If Customer does not object in this time period, the European Economic Area (“EEA”) and/or their Member States and Switzerland sub-processor will be deemed accepted. If Customer rejects the replacement sub-processor, Digital Realty may terminate the services relying on the replacement sub-processor with immediate effect on written notice to Third Countries, to the extent such transfers are subject to Customer. 5.3 Digital Realty is responsible under the Applicable Data Protection Law, Laws for the Processor shall secure acts or omissions of its sub-processors to the transfer same extent it would be liable if performing the Services of each Sub-processor directly under the EU- US Privacy Shield pursuant terms of this DPA. Digital Realty will impose data protection obligations upon any sub-processor that are no less protective than those included in this DPA. This DPA may be executed electronically and in any number of counterparts, each of which is an original and all of which evidence the same agreement between the parties. Except for matters covered by this DPA, this DPA is subject to Decision 2016/1250/EU (“Privacy Shield”), the terms of the Agreement. Except as specifically amended and modified by this DPA, the terms and provisions of the Agreement remain unchanged and in full force and effect. The exclusions and limitations on liability contained in the Agreement shall apply to any liability arising under or in respect of this DPA. The terms of this DPA will control to the extent there is any conflict between terms of this DPA and the terms of the Agreement. If there is any conflict between this DPA and the Standard Contractual Clauses, the Standard Contractual Clauses for the Transfer of will prevail with respect to Personal Data that is subject to Processors Established in Third Countries pursuant to Decision 2010/87/EU (“Model Clauses”) GDPR or such other mechanism approved by the European Commission and valid from time to timeUK GDPR. (e) The Processor and/or Wolters Kluwer group shall choose the Sub-processor(s) diligently. (f) The Processor shall remain liable to the Controller for the performance of the Sub-processor’s obligations, should the Sub-processor fail to fulfil its obligations. However, the Processor shall not be liable for damages and claims that ensue from the Controller’s instructions to Sub-processors. (g) The provisions of this clause 5 shall not apply to the extent Controller instructs the Processor to allow a third party to Process Controller’s Personal Data pursuant to a contract that Controller has directly with the third party.

Sub-Processing. 5.1. The Customer provides general authorization for Akeyless to engage third party data Processors (a) The Controller hereby authorizes the appointment and use of “Sub-processor(sProcessor”) engaged by the Processor for the provision of the Servicesto Process Customer Data. The Controller approves the Sub-processor(s) set out in Annex 5. (b) The Controller acknowledges and agrees that: (i) Wolters Kluwer group may be retained as Sub- processors; and (ii) the Processor and Wolters Kluwer group respectively may engage third-party Sub- processors (and permit each Sub-Processor appointed under this clause 5 to appoint sub-processors) in connection with the provision of the Services. (c) In case the Processor intends to engage new or additional Sub-processors, the Controller hereby provides general written authorization for the Processor to do so, provided that the Processor shall inform the Controller of any intended changes concerning the addition or replacement of any Sub-processor ("Sub-processor Notice") such notice to be provided though CCH OneClick or on the GDPR page at Customer specifically authorizes ▇▇▇▇▇://▇▇▇▇ to engage and appoint such Sub-Processors as listed in Annex III, to Process Customer Data, as well as permits each Sub-Processor to appoint a Sub-Processor on its behalf.▇▇▇.▇▇.▇▇/softwaresupport/2015/home.asp 5.2. Akeyless may engage an additional or replace an existing Sub-Processors to Process Customer Data, subject to the provision of a thirty (30) days prior notice of its intention to do so to the Customer (such notice can be provided through the Customer account or through an email correspondence) (“Notice” and “Notice Period” respectively). In case the Customer has not objected to the adding or replacing of a Sub-processor List Website”). The Controller is responsible for visiting the Processor within Notice Period, such Sub-processor List Website from time to time. If Processor shall be deemed approved by the Controller has a reasonable basis to object to the use of any such new or additional Sub-processor, the Controller shall notify the Processor promptly in writing within 14 days after receipt of the Sub-processor NoticeCustomer. In the event the Controller Customer objects to the adding or replacing of a new or additional Sub-processorProcessor, and that objection is not unreasonablewithin such Notice Period, Akeyless may, under ▇▇▇▇▇▇▇▇’ sole discretion, suggest the engagement of a different Sub-Processor will use reasonable efforts for the same course of services, or otherwise enable the Customer to make available to terminate the Controller a change in the S ervices or recommend a commercially reasonable change to the Controller’s configuration or use of Agreement where the Services to avoid Processing of Personal Data by the objected-to new or additional Sub-processor without unreasonably burdening the Controller. If the Processor is unable to make available cannot be reasonably provided under such change within a reasonable period of timecircumstances, which shall not exceed ninety (90) days, the Controller may terminate (notwithstanding any contrary provision in the Services Agreement and without liability to the Controller) the affected part of the Services Agreement with respect only to those Services which cannot be provided by the Processor without the use of the objected-to new or additional Customer. 5.3. Akeyless shall, where it engages any Sub-processor by providing written notice to Processor, impose, through a legally binding contract between Akeyless and the Sub-Processor. (d) The Processor and/or Wolters Kluwer group shall impose the same , data protection obligations as that are no less onerous than, and provide at least the same level of protection as, those set out in this DPA on any DPA. Akeyless shall ensure that such contract will require the Sub-processor by contract. The contract between the Processor and the Sub- processor shall in particular to provide sufficient guarantees to implement appropriate technical and organizational measures in such a manner that the Technical and Organizational Security Measures as specified in Annex 4Processing will meet the requirements of Data Protection Laws. Sub-processors shall be obligated, contractually, to the extent such Technical and Organizational Security Measures are relevant for the services provided by the Sub-processor. The Controller agrees that in respect of transfers of Personal Data under this DPA from the EUreasonably cooperate with Akeyless, the European Economic Area (“EEA”) and/or their Member States and Switzerland to Third Countries, Customer or an applicable regulatory authority in the event of an investigation or Security Incident. 5.4. ▇▇▇▇▇▇▇▇ shall remain responsible to the extent such transfers are subject to the Applicable Data Protection Law, the Processor shall secure the transfer under the EU- US Privacy Shield pursuant to Decision 2016/1250/EU (“Privacy Shield”), the terms of the Standard Contractual Clauses for the Transfer of Personal Data to Processors Established in Third Countries pursuant to Decision 2010/87/EU (“Model Clauses”) or such other mechanism approved by the European Commission and valid from time to time. (e) The Processor and/or Wolters Kluwer group shall choose the Sub-processor(s) diligently. (f) The Processor shall remain liable to the Controller Customer for the performance of the Sub-processorProcessor’s obligations, should the Sub-processor fail to fulfil its obligations. However, the Processor shall not be liable for damages and claims that ensue from the Controller’s instructions to Sub-processorsobligations in accordance with this DPA. (g) The provisions of this clause 5 shall not apply to the extent Controller instructs the Processor to allow a third party to Process Controller’s Personal Data pursuant to a contract that Controller has directly with the third party.

Sub-Processing. (a) 8.1 The Controller hereby authorizes Supplier may Process the appointment Personal Data in the locations and use of Sub-processor(s) engaged by the Processor for the provision of the Services. The Controller approves with the Sub-processor(s) processors set out in Annex 5.2 to this Schedule in order to perform the Services.‌ (b) 8.2 The Controller acknowledges and agrees that: (i) Wolters Kluwer group Customer may be retained as Sub- processors; and (ii) the Processor and Wolters Kluwer group respectively may engage third-party Sub- processors (and permit each receive notifications of new Sub-Processor appointed under this clause 5 processors and updates to appoint subexisting Sub-processors) in connection processors by subscribing for updates. If the Customer subscribes, the Supplier will provide the subscriber with the provision written notice of the Services. (c) In case the Processor intends to engage appointment of any new or additional Sub-processorsprocessor, including full details of the Processing to be undertaken by the Sub-processor. If, within thirty (30) days of receipt of that notice, the Controller hereby provides general written authorization for Company notifies the Processor to do so, provided that the Processor shall inform the Controller Supplier in writing of any intended changes concerning reasonable objections to the addition or replacement of proposed appointment, neither the Supplier nor any Supplier Affiliate shall disclose any Personal Data to that proposed Sub-processor ("Sub-processor Notice") such notice until reasonable steps have been taken to be address the objections raised by the Customer and the Customer has been provided though CCH OneClick or on the GDPR page at ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇.▇▇/softwaresupport/2015/home.asp (“Sub-processor List Website”). The Controller is responsible for visiting the Sub-processor List Website from time to time. If the Controller has with a reasonable basis written explanation of the steps taken. 8.3 In the event the Customer objects to object to the use of any such a new or additional Sub-processor, the Controller shall notify the Processor promptly in writing within 14 days after receipt of the Sub-processor Notice. In the event the Controller objects to a new or additional Sub-processor, and that objection is not unreasonable, the Processor Supplier will use reasonable efforts to make available to the Controller a change in the S ervices or recommend a commercially reasonable change to the Controlleraffected Services available or recommend commercially reasonable changes to the Customer’s configuration or use of the Services to avoid the Processing that is the subject of Personal Data by the objected-to new or additional Sub-processor without unreasonably burdening the Controllerobjection. If the Processor Supplier is unable to make available such change changes within a reasonable period of time, which shall not exceed ninety (90) days, the Controller Customer may terminate (notwithstanding any contrary provision in the Services Agreement and without liability to the Controller) the affected part of the Services Agreement applicable Service Order with respect only to those Services which cannot be provided by the Processor Supplier without the use of the objected-to new or additional Sub-processor by providing written notice to the ProcessorSupplier. The Supplier will then refund the Customer any prepaid fees covering the remainder of the term of such Service Order following the effective date of termination with respect to such terminated Services. 8.4 The Customer provides a general consent for the Supplier to engage onward Sub-processors, provided the following requirements are satisfied: (da) any onward sub-processor must agree in writing to only process data in a country that the European Commission has declared to have an “adequate” level of protection or to only process data on terms equivalent to the applicable Standard Contractual Clauses, or pursuant to Binding Corporate Rules and (b) the Supplier will restrict the onward Sub-processor’s access to Personal Data only to what is strictly necessary to provide the Services, and will prohibit the Sub-processor from processing the Personal Data for any other purpose. 8.5 The Processor and/or Wolters Kluwer group shall impose the same Supplier will enter into a written agreement with each Sub-processor containing data protection obligations as set out no less protective than those contained in this DPA on Data Protection Schedule with respect to the protection of Personal Data. The Parties agree that the copies of the Sub-processor agreements that must be provided by the Supplier to the Customer pursuant to the relevant Standard Contractual Clauses may have all commercial information, or clauses unrelated to the Standard Contractual Clauses or their equivalent, removed by the Supplier beforehand; and, that such copies will be provided by the Supplier, in a manner to be determined in its discretion, only upon the written request of the Customer. 8.6 Use of a Sub-processor will not relieve, waive or diminish any obligation the Supplier has under the Agreement and the Supplier is liable for any acts or omissions of any Sub-processor by contract. The contract between the Processor and the Sub- processor shall in particular provide sufficient guarantees to implement the Technical and Organizational Security Measures as specified in Annex 4, to the same extent such Technical and Organizational Security Measures are relevant for as if the services provided acts or omissions were performed by the Sub-processor. The Controller agrees that in respect of transfers of Personal Data under this DPA from the EU, the European Economic Area (“EEA”) and/or their Member States and Switzerland to Third Countries, to the extent such transfers are subject to the Applicable Data Protection Law, the Processor shall secure the transfer under the EU- US Privacy Shield pursuant to Decision 2016/1250/EU (“Privacy Shield”), the terms of the Standard Contractual Clauses for the Transfer of Personal Data to Processors Established in Third Countries pursuant to Decision 2010/87/EU (“Model Clauses”) or such other mechanism approved by the European Commission and valid from time to time. (e) The Processor and/or Wolters Kluwer group shall choose the Sub-processor(s) diligently. (f) The Processor shall remain liable to the Controller for the performance of the Sub-processor’s obligations, should the Sub-processor fail to fulfil its obligations. However, the Processor shall not be liable for damages and claims that ensue from the Controller’s instructions to Sub-processors. (g) The provisions of this clause 5 shall not apply to the extent Controller instructs the Processor to allow a third party to Process Controller’s Personal Data pursuant to a contract that Controller has directly with the third party.Supplier.‌

Sub-Processing. (a) The Controller hereby authorizes the appointment and use of 6.1 Customer generally authorises Raft to appoint Sub-processor(s) engaged by Processors in accordance with this Section 6. Without limitation to the Processor for foregoing, Customer authorises the provision engagement of the Services. The Controller approves Sub- Processors listed as of the Addendum Effective Date at the URL specified in Section 6.2. 6.2 Information about Raft’s Sub-processor(s) set out in Annex 5. (b) The Controller acknowledges Processors, including their functions and agrees thatlocations, is available at: (i) Wolters Kluwer group may be retained as Sub- processors; and (ii) the Processor and Wolters Kluwer group respectively may engage third-party Sub- processors (and permit each Sub-Processor appointed under this clause 5 to appoint sub-processors) in connection with the provision of the Services. (c) In case the Processor intends to engage new or additional Sub-processors, the Controller hereby provides general written authorization for the Processor to do so, provided that the Processor shall inform the Controller of any intended changes concerning the addition or replacement of any Sub-processor ("Sub-processor Notice") such notice to be provided though CCH OneClick or on the GDPR page at ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇.▇▇/softwaresupport/2015/home.asp ▇▇▇▇-▇▇▇▇▇▇▇▇▇▇▇▇▇-▇▇▇▇▇▇ in the Data Processing Agreement section (as may be updated by Raft from time-to-time) or such other website address as Raft may provide to Customer from time to time (the “Sub-processor List WebsiteProcessor Site”). The Controller is responsible for visiting . 6.3 When Raft engages any Sub-Processor after the Addendum Effective Date, Raft will notify Customer of the engagement (including the name and location of the relevant Sub-Processor and the activities it will perform) by updating the Sub-processor List Website from time to timeProcessor Site or by other written means at least thirty (30) days before such Sub-Processor Processes Customer Personal Data. If the Controller has a If, within ten (10) days of being notified of such engagement, Customer notifies Raft in writing of any objections (on reasonable basis to object grounds) to the use of any such new or additional Sub-processor, the Controller proposed appointment: (a) Raft shall notify the Processor promptly in writing within 14 days after receipt of the Sub-processor Notice. In the event the Controller objects to a new or additional Sub-processor, and that objection is not unreasonable, the Processor will use reasonable efforts to make available to the Controller a change in the S ervices or recommend a commercially reasonable change to in the Controller’s configuration or provision of the Services, which avoids the use of the Services to avoid Processing of Personal Data by the objected-to new or additional that proposed Sub-processor without unreasonably burdening the Controller. If the Processor is unable to make available Processor; and (b) where: (i) such a change within a reasonable period of time, which shall not exceed ninety (90) days, the Controller may terminate (notwithstanding any contrary provision in the Services Agreement and without liability to the Controller) the affected part of the Services Agreement with respect only to those Services which cannot be provided made within thirty (30) days from Raft’s receipt of Customer’s notice; (ii) no commercially reasonable change is available; and/or (iii) Customer declines to bear the cost of the proposed change, then either Party may by written notice to the Processor without other Party with immediate effect terminate the SaaS Agreement, either in whole or to the extent that it relates to the Services which require the use of the objected-to new or additional proposed Sub-processor by providing written notice Processor, as its sole and exclusive remedy. 6.4 If Customer does not object to ▇▇▇▇’s appointment of a Sub-Processor during the objection period referred to in Section 6.3, Customer shall be deemed to have approved the engagement and ongoing use of that Sub-Processor. (d) The 6.5 With respect to each Sub-Processor, Raft shall maintain a written contract between Raft and the Sub-Processor and/or Wolters Kluwer group shall impose the same data that includes terms which offer a level of protection obligations as for Customer Personal Data substantially similar to those set out in this DPA on any Sub-processor by contract(including the Security Measures). The contract between the Processor and the Sub- processor shall in particular provide sufficient guarantees to implement the Technical and Organizational Security Measures as specified in Annex 4, to the extent such Technical and Organizational Security Measures are relevant for the services provided by the Sub-processor. The Controller agrees that in respect of transfers of Personal Data under this DPA from the EU, the European Economic Area (“EEA”) and/or their Member States and Switzerland to Third Countries, to the extent such transfers are subject to the Applicable Data Protection Law, the Processor shall secure the transfer under the EU- US Privacy Shield pursuant to Decision 2016/1250/EU (“Privacy Shield”), the terms of the Standard Contractual Clauses for the Transfer of Personal Data to Processors Established in Third Countries pursuant to Decision 2010/87/EU (“Model Clauses”) or such other mechanism approved by the European Commission and valid from time to time. (e) The Processor and/or Wolters Kluwer group shall choose the Sub-processor(s) diligently. (f) The Processor Raft shall remain liable for any breach of this DPA caused by a Sub-Processor to the Controller for same extent as Raft would have been had Raft performed the performance of the Sub-processor’s obligations, should the Sub-processor fail to fulfil its obligations. However, the Processor shall not be liable for damages and claims that ensue from the Controller’s instructions to Sub-processorsProcessing itself. (g) The provisions of this clause 5 shall not apply to the extent Controller instructs the Processor to allow a third party to Process Controller’s Personal Data pursuant to a contract that Controller has directly with the third party.

Sub-Processing. (a) 8.1 The Controller hereby authorizes Processor is authorised to use sub-processors without further written permission from the appointment and use Controller. An updated list of the Processor´s Sub-processor(s) engaged by the Processor for the provision of the Services. The Controller approves the Sub-processor(s) set out in Annex 5. (b) The Controller acknowledges and agrees that: (i) Wolters Kluwer group may processors can be retained as Sub- processors; and (ii) the Processor and Wolters Kluwer group respectively may engage third-party Sub- processors (and permit each Sub-Processor appointed under this clause 5 to appoint sub-processors) in connection with the provision of the Services. (c) In case the Processor intends to engage new or additional Sub-processors, the Controller hereby provides general written authorization for the Processor to do so, provided that the Processor shall inform the Controller of any intended changes concerning the addition or replacement of any Sub-processor ("Sub-processor Notice") such notice to be provided though CCH OneClick or on the GDPR page found at ▇▇▇▇▇://▇▇▇.▇▇▇.▇ ▇▇▇▇.▇▇/softwaresupport/2015▇/home.asp (“Sub▇▇▇▇▇▇▇▇▇▇▇▇▇. The Processor shall notify the Controller in writing of the identity of new sub-processors before entering into an agreement with the respective sub-processors, allowingthe Controller to reasonably object to the appointment of the sub-processor List Website”)in question within 2weeks after having received notice. 8.2 With respect to Forecast’s other sub-processors, Forecast will endeavor to give notice thirty (30) business days prior to any planned major additions or replacements, but will give notice no less than ten (10) business days prior to any such change. The Controller is responsible for visiting Clauses on business related issues that do not affect the Sublegal data protection content of the sub-processor List Website from time agreement, shall not require submission to the Controller. 8.3 Having received notice, the Controller has the right to make objections in writing and on reason- able grounds to the appointment of the new sub-processor within ten (10) business days. If no objection has been raised within this time, the Processor will deem the Controller to have au- thorized the new sub-processor. If the Controller has a reasonable basis refuses to object consent to the use Processors´ appoint- ment of any such new or additional Suba sub-processorprocessors on reasonable grounds, the Controller shall notify the Processor promptly in writing within 14 days after receipt of the Sub-processor Notice. In the event the Controller objects to a new or additional Sub-processor, and that objection is not unreasonable, then the Processor will use reasonable efforts either look for alter- native solutions or not appoint the sub-processor. In case of disagreement between the Parties concerning the appointment, then either party has the right to make available suspend or terminate this DPA (and any other agreement between the Parties relating to the Controller a change in the S ervices or recommend a commercially reasonable change to the Controller’s configuration or use provision of the Services to avoid Processing of Personal Data services by the objected-to new or additional Sub-processor without unreasonably burdening the Controller. If the Processor is unable to make available such change within a reasonable period of time, which shall not exceed ninety (90) days, the Controller may terminate (notwithstanding any contrary provision in the Services Agreement and without liability Pro- cessor to the Controller) without penalty for both parties. 8.4 Prior to letting the affected part of the Services Agreement with respect only to those Services which cannot be provided by sub-processor commence processing personal data, the Processor without shall en- ter into a written agreement with the use of sub-processor, making the objected-to new or additional Subsub-processor by providing written notice subject as a minimum to the Processor. (d) The Processor and/or Wolters Kluwer group shall impose the same data protection obligations as set out in this DPA on any Sub-processor by contract. The contract between which the Processor and is subject to under the Sub- processor shall in particular provide sufficient guarantees DPA, including the obli- gation to implement adequate technical and organisational measures to ensure that the Technical and Organizational Security Measures as specified in Annex 4, to the extent such Technical and Organizational Security Measures are relevant for the services provided by the Sub-processor. The Controller agrees that in respect require- ments of transfers of Personal Data under this DPA from the EU, the European Economic Area (“EEA”) and/or their Member States and Switzerland to Third Countries, to the extent such transfers are subject to the Applicable Data Protection Law, the Processor shall secure the transfer under the EU- US Privacy Shield pursuant to Decision 2016/1250/EU (“Privacy Shield”), the terms of the Standard Contractual Clauses for the Transfer of Personal Data to Processors Established in Third Countries pursuant to Decision 2010/87/EU (“Model Clauses”) or such other mechanism approved by the European Commission and valid from time to timeLaw be satisfied. (e) The Processor and/or Wolters Kluwer group shall choose the Sub-processor(s) diligently. (f) The Processor shall remain liable to the Controller for the performance of the Sub-processor’s obligations, should the Sub-processor fail to fulfil its obligations. However, the Processor shall not be liable for damages and claims that ensue from the Controller’s instructions to Sub-processors. (g) The provisions of this clause 5 shall not apply to the extent Controller instructs the Processor to allow a third party to Process Controller’s Personal Data pursuant to a contract that Controller has directly with the third party.

Sub-Processing. (a) 8.1 The Controller hereby authorizes Processor is authorised to use sub-processors without further written permission from the appointment and use Controller. An updated list of the Processor´s Sub-processor(s) engaged by the Processor for the provision of the Services. The Controller approves the Sub-processor(s) set out in Annex 5. (b) The Controller acknowledges and agrees that: (i) Wolters Kluwer group may processors can be retained as Sub- processors; and (ii) the Processor and Wolters Kluwer group respectively may engage third-party Sub- processors (and permit each Sub-Processor appointed under this clause 5 to appoint sub-processors) in connection with the provision of the Services. (c) In case the Processor intends to engage new or additional Sub-processors, the Controller hereby provides general written authorization for the Processor to do so, provided that the Processor shall inform the Controller of any intended changes concerning the addition or replacement of any Sub-processor ("Sub-processor Notice") such notice to be provided though CCH OneClick or on the GDPR page found at ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇▇▇▇.▇▇/softwaresupport/2015/home.asp (“Sub▇/subprocessors. The Processor shall notify the Controller in writing of the identity of new sub-processors before entering into an agreement with the respective sub-processors, allowing the Controller to reasonably object to the appointment of the sub-processor List Website”)in question within 2 weeks after having received notice. 8.2 With respect to Forecast’s other sub-processors, Forecast will endeavor to give notice thirty (30) business days prior to any planned major additions or replacements, but will give notice no less than ten (10) business days prior to any such change. The Controller is responsible for visiting Clauses on business related issues that do not affect the Sublegal data protection content of the sub-processor List Website from time agreement, shall not require submission to the Controller. 8.3 Having received notice, the Controller has the right to make objections in writing and on reasonable grounds to the appointment of the new sub-processor within ten (10) business days. If no objection has been raised within this time, the Processor will deem the Controller to have authorized the new sub-processor. If the Controller has a reasonable basis refuses to object consent to the use Processors´ appointment of any such new or additional Suba sub-processorprocessors on reasonable grounds, the Controller shall notify the Processor promptly in writing within 14 days after receipt of the Sub-processor Notice. In the event the Controller objects to a new or additional Sub-processor, and that objection is not unreasonable, then the Processor will use reasonable efforts either look for alternative solutions or not appoint the sub-processor. In case of disagreement between the Parties concerning the appointment, then either party has the right to make available suspend or terminate this Agreement (and any other agreement between the Parties relating to the Controller a change in the S ervices or recommend a commercially reasonable change to the Controller’s configuration or use provision of the Services to avoid Processing of Personal Data services by the objected-to new or additional Sub-processor without unreasonably burdening the Controller. If the Processor is unable to make available such change within a reasonable period of time, which shall not exceed ninety (90) days, the Controller may terminate (notwithstanding any contrary provision in the Services Agreement and without liability to the Controller) without penalty for both parties. 8.4 Prior to letting the affected part of the Services Agreement with respect only to those Services which cannot be provided by the Processor without the use of the objected-to new or additional Subsub-processor by providing written notice to the Processor. (d) The Processor and/or Wolters Kluwer group shall impose the same data protection obligations as set out in this DPA on any Sub-processor by contract. The contract between the Processor and the Sub- processor shall in particular provide sufficient guarantees to implement the Technical and Organizational Security Measures as specified in Annex 4, to the extent such Technical and Organizational Security Measures are relevant for the services provided by the Sub-processor. The Controller agrees that in respect of transfers of Personal Data under this DPA from the EU, the European Economic Area (“EEA”) and/or their Member States and Switzerland to Third Countries, to the extent such transfers are subject to the Applicable Data Protection Lawcommence processing personal data, the Processor shall secure enter into a written agreement with the transfer sub-processor, making the sub-processor subject as a minimum to the obligations which the Processor is subject to under the EU- US Privacy Shield pursuant DPA, including the obligation to Decision 2016/1250/EU (“Privacy Shield”), implement adequate technical and organisational measures to ensure that the terms requirements of the Standard Contractual Clauses for the Transfer of Personal General Data to Processors Established in Third Countries pursuant to Decision 2010/87/EU (“Model Clauses”) or such other mechanism approved by the European Commission and valid from time to timeProtection Regulation be satisfied. (e) The Processor and/or Wolters Kluwer group shall choose the Sub-processor(s) diligently. (f) The Processor shall remain liable to the Controller for the performance of the Sub-processor’s obligations, should the Sub-processor fail to fulfil its obligations. However, the Processor shall not be liable for damages and claims that ensue from the Controller’s instructions to Sub-processors. (g) The provisions of this clause 5 shall not apply to the extent Controller instructs the Processor to allow a third party to Process Controller’s Personal Data pursuant to a contract that Controller has directly with the third party.

Sub-Processing. (a) The Controller hereby authorizes the appointment and use of Sub-processor(s) engaged by the Processor for the provision of the Services. The Controller approves the Sub-processor(s) set out in Annex 5. (b) The Controller acknowledges and agrees that: (i) Wolters Kluwer group may be retained as Sub- Sub-processors; and (ii) the Processor and Wolters Kluwer group respectively may engage third-party Sub- Sub-processors (and permit each Sub-Processor appointed under this clause 5 to appoint sub-processors) in connection with the provision of the Services. (c) In case the Processor intends to engage new or additional Sub-processors, the Controller hereby provides general written authorization for the Processor to do so, provided that the Processor shall inform the Controller of any intended changes concerning the addition or replacement of any Sub-processor ("Sub-processor Notice") such notice to be provided though CCH OneClick or on the GDPR page at ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇.▇▇/softwaresupport/2015/home.asp (“Sub-Sub- processor List Website”). The Controller is responsible for visiting the Sub-processor List Website from time to time. If the Controller has a reasonable basis to object to the use of any such new or additional Sub-processor, the Controller shall notify the Processor promptly in writing within 14 days after receipt of the Sub-processor Notice. In the event the Controller objects to a new or additional Sub-processor, and that objection is not unreasonable, the Processor will use reasonable efforts to make available to the Controller a change in the S ervices Services or recommend a commercially reasonable change to the Controller’s configuration or use of the Services to avoid Processing of Personal Data by the objected-to new or additional Sub-processor without unreasonably burdening the Controller. If the Processor is unable to make available such change within a reasonable period of time, which shall not exceed ninety (90) days, the Controller may terminate (notwithstanding any contrary provision in the Services Agreement and without liability to the Controller) the affected part of the Services Agreement with respect only to those Services which cannot be provided by the Processor without the use of the objected-to new or additional Sub-processor by providing written notice to the Processor. (d) The Processor and/or Wolters Kluwer group shall impose the same data protection obligations as set out in this DPA on any Sub-processor by contract. The contract between the Processor and the Sub- Sub-processor shall in particular provide sufficient guarantees to implement the Technical and Organizational Security Measures as specified in Annex 4, to the extent such Technical and Organizational Security Measures are relevant for the services provided by the Sub-processor. The Controller agrees that in respect of transfers of Personal Data under this DPA from the EU, the European Economic Area (“EEA”) and/or their Member States and Switzerland to Third Countries, to the extent such transfers are subject to the Applicable Data Protection Law, the Processor shall secure the transfer under the EU- US Privacy Shield pursuant to Decision 2016/1250/EU (“Privacy Shield”), the terms of the Standard Contractual Clauses for the Transfer of Personal Data to Processors Established in Third Countries pursuant to Decision 2010/87/EU (“Model Clauses”) or such other mechanism approved by the European Commission and valid from time to time. (e) The Processor and/or Wolters Kluwer group shall choose the Sub-processor(s) diligently. (f) The Processor shall remain liable to the Controller for the performance of the Sub-processor’s obligations, should the Sub-processor fail to fulfil its obligations. However, the Processor shall not be liable for damages and claims that ensue from the Controller’s instructions to Sub-processors. (g) The provisions of this clause 5 shall not apply to the extent Controller instructs the Processor to allow a third party to Process Controller’s Personal Data pursuant to a contract that Controller has directly with the third party.

Sub-Processing. The Processor may use another Processor (hereinafter the Sub-Processor). By signing this DPA, the Controller grants the Processor the general authorisation to recruit Sub-Processors. The Processor may continue to work with Sub-Processors that had already been appointed on the effective date of the DPA provided the following conditions are met without undue delay. These terms and conditions shall apply to all Sub-Processors: a) The Controller hereby authorizes the appointment and use of Sub-processor(s) engaged by the Processor for the provision of the Services. The Controller approves must ensure in advance that the Sub-processor(sProcessor can provide sufficient guarantees regarding the implementation of Appropriate Technical and Organisational Measures such that the Processing meets GDPR requirements. b) The Processor shall contractually impose on the Sub-Processor the same Data Protection obligations as those set out in Annex 5. (b) The Controller acknowledges and agrees that: (i) Wolters Kluwer group may be retained as Sub- processors; and (ii) Article 4 of this DPA. Within the framework of this general authorisation, the Processor and Wolters Kluwer group respectively may engage third-party Sub- processors undertakes to inform the Controller, subject to at least two (and permit each Sub-Processor appointed under this clause 5 to appoint sub-processors2) in connection with the provision weeks’ advance notice, of the Services. (c) In case the Processor intends to engage new or additional Sub-processors, the Controller hereby provides general written authorization for the Processor to do so, provided that the Processor shall inform the Controller of any intended changes concerning envisaged regarding the addition or replacement of any Sub-processor ("Sub-processor Notice") such notice Processors, allowing the Controller to be provided though CCH OneClick or object to these changes on the GDPR page at ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇.▇▇/softwaresupport/2015/home.asp (“Sub-processor List Website”)reasonable grounds. The Controller is responsible for visiting the Sub-processor List Website from time Unreasonable and invalid objections shall include but are not limited to time. If undocumented objections; reasonable and valid objections include but are not limited to situations where the Controller has a reasonable basis documented reasons to object to question the use of any such new or additional Sub-processor, the Controller shall notify the Processor promptly in writing within 14 days after receipt ability of the Sub-processor NoticeProcessor to protect the Personal Data and keep it confidential. In To be valid, objections must be raised before half of the event the Controller objects to advance notice has expired. The Processor shall provide a new or additional Sub-processor, and that objection is not unreasonable, the Processor will use reasonable efforts to make available reasoned reply to the Controller a change in the S ervices or recommend a commercially (reasonable change to the Controller’s configuration or use of the Services to avoid Processing of Personal Data by the objected-to new or additional Sub-processor without unreasonably burdening the Controllerand valid) objections raised. If the Processor is unable to make available such change within a reasonable period of time, which shall not exceed ninety (90) days, the Controller may terminate (notwithstanding any contrary provision in the Services Agreement and without liability to the Controller) the affected part of the Services Agreement with respect only to those Services which cannot be provided by the Processor without the use of the objected-to new or additional Sub-processor by providing written notice to the Processor. (d) The Processor and/or Wolters Kluwer group shall impose the same data protection obligations as set out in this DPA on any Sub-processor by contract. The contract between the Processor and the Sub- processor shall in particular provide sufficient guarantees to implement the Technical and Organizational Security Measures as specified in Annex 4, to the extent such Technical and Organizational Security Measures are relevant for the services provided by Should the Sub-processor. The Controller agrees that in respect of transfers of Personal Data under this DPA from the EU, the European Economic Area (“EEA”) and/or their Member States and Switzerland Processor fail to Third Countries, to the extent such transfers are subject to the Applicable fulfil its Data Protection Lawobligations, the Processor shall secure the transfer under the EU- US Privacy Shield pursuant to Decision 2016/1250/EU (“Privacy Shield”), the terms of the Standard Contractual Clauses for the Transfer of Personal Data to Processors Established in Third Countries pursuant to Decision 2010/87/EU (“Model Clauses”) or such other mechanism approved by the European Commission and valid from time to time. (e) The Processor and/or Wolters Kluwer group shall choose the Sub-processor(s) diligently. (f) The Processor shall remain fully liable to towards the Controller for the performance of the Sub-processorProcessor’s obligations, should the Sub-processor fail to fulfil its obligations. However, the Processor shall not be liable for damages and claims that ensue from the Controller’s instructions to Sub-processors. (g) The provisions of this clause 5 shall not apply to the extent Controller instructs the Processor to allow a third party to Process Controller’s Personal Data pursuant to a contract that Controller has directly with the third party.

Sub-Processing. (a) 8.1 The Controller hereby authorizes Processor is authorised to use sub-processors without further written permission from the appointment and use Controller. An updated list of the Processor´s Sub-processor(s) engaged by the Processor for the provision of the Services. The Controller approves the Sub-processor(s) set out in Annex 5. (b) The Controller acknowledges and agrees that: (i) Wolters Kluwer group may processors can be retained as Sub- processors; and (ii) the Processor and Wolters Kluwer group respectively may engage third-party Sub- processors (and permit each Sub-Processor appointed under this clause 5 to appoint sub-processors) in connection with the provision of the Services. (c) In case the Processor intends to engage new or additional Sub-processors, the Controller hereby provides general written authorization for the Processor to do so, provided that the Processor shall inform the Controller of any intended changes concerning the addition or replacement of any Sub-processor ("Sub-processor Notice") such notice to be provided though CCH OneClick or on the GDPR page found at ▇▇▇▇▇://▇▇▇.▇▇▇.▇- ▇▇▇▇.▇▇/softwaresupport/2015▇/home.asp (“Sub▇▇▇▇▇▇▇▇▇▇▇▇▇. The Processor shall notify the Controller in writing of the identity of new sub-processors before entering into an agreement with the respective sub-processors, allowing the Controller to reasonably object to the appointment of the sub-processor List Website”)in question within 2 weeks after having received notice. 8.2 With respect to Forecast’s other sub-processors, Forecast will endeavor to give notice thirty (30) business days prior to any planned major additions or replacements, but will give notice no less than ten (10) business days prior to any such change. The Controller is responsible for visiting Clauses on business related issues that do not affect the Sublegal data protection content of the sub-processor List Website from time agreement, shall not require submission to the Controller. 8.3 Having received notice, the Controller has the right to make objections in writing and on reason- able grounds to the appointment of the new sub-processor within ten (10) business days. If no objection has been raised within this time, the Processor will deem the Controller to have au- thorized the new sub-processor. If the Controller has a reasonable basis refuses to object consent to the use Processors´ appoint- ment of any such new or additional Suba sub-processorprocessors on reasonable grounds, the Controller shall notify the Processor promptly in writing within 14 days after receipt of the Sub-processor Notice. In the event the Controller objects to a new or additional Sub-processor, and that objection is not unreasonable, then the Processor will use reasonable efforts either look for alter- native solutions or not appoint the sub-processor. In case of disagreement between the Parties Last update: 8th November 2021 concerning the appointment, then either party has the right to make available suspend or terminate this DPA (and any other agreement between the Parties relating to the Controller a change in the S ervices or recommend a commercially reasonable change to the Controller’s configuration or use provision of the Services to avoid Processing of Personal Data services by the objected-to new or additional Sub-processor without unreasonably burdening the Controller. If the Processor is unable to make available such change within a reasonable period of time, which shall not exceed ninety (90) days, the Controller may terminate (notwithstanding any contrary provision in the Services Agreement and without liability Pro- cessor to the Controller) without penalty for both parties. 8.4 Prior to letting the affected part of the Services Agreement with respect only to those Services which cannot be provided by sub-processor commence processing personal data, the Processor without shall en- ter into a written agreement with the use of sub-processor, making the objected-to new or additional Subsub-processor by providing written notice subject as a minimum to the Processor. (d) The Processor and/or Wolters Kluwer group shall impose the same data protection obligations as set out in this DPA on any Sub-processor by contract. The contract between which the Processor and is subject to under the Sub- processor shall in particular provide sufficient guarantees DPA, including the obli- gation to implement adequate technical and organisational measures to ensure that the Technical and Organizational Security Measures as specified in Annex 4, to the extent such Technical and Organizational Security Measures are relevant for the services provided by the Sub-processor. The Controller agrees that in respect require- ments of transfers of Personal Data under this DPA from the EU, the European Economic Area (“EEA”) and/or their Member States and Switzerland to Third Countries, to the extent such transfers are subject to the Applicable Data Protection Law, the Processor shall secure the transfer under the EU- US Privacy Shield pursuant to Decision 2016/1250/EU (“Privacy Shield”), the terms of the Standard Contractual Clauses for the Transfer of Personal Data to Processors Established in Third Countries pursuant to Decision 2010/87/EU (“Model Clauses”) or such other mechanism approved by the European Commission and valid from time to timeLaw be satisfied. (e) The Processor and/or Wolters Kluwer group shall choose the Sub-processor(s) diligently. (f) The Processor shall remain liable to the Controller for the performance of the Sub-processor’s obligations, should the Sub-processor fail to fulfil its obligations. However, the Processor shall not be liable for damages and claims that ensue from the Controller’s instructions to Sub-processors. (g) The provisions of this clause 5 shall not apply to the extent Controller instructs the Processor to allow a third party to Process Controller’s Personal Data pursuant to a contract that Controller has directly with the third party.