Common use of TO THE STANDARD CONTRACTUAL CLAUSES Clause in Contracts

TO THE STANDARD CONTRACTUAL CLAUSES. This Appendix forms part of the Clauses and must be completed and signed by the parties. The Member States may complete or specify, according to their national procedures, any additional necessary information to be contained in this Appendix. Data exporter The data exporter is (please specify briefly your activities relevant to the transfer): Data exporter is the legal entity that has executed the Data Processing Addendum based on the Standard Contractual Clauses as a Data Exporter established within the European Economic area and Switzerland that have purchased the Service on the basis of one or more Order Form(s). Data importer The data importer is (please specify briefly activities relevant to the transfer): Data importer, Okta, Inc., is an identity and access management cloud service provider which Processes Personal Data, where such data is Customer Data, upon the instruction of the data exporter in accordance with the terms of the Agreement and the Data Processing Addendum. Data subjects The personal data transferred concern the following categories of data subjects (please specify): Data exporter may submit Personal Data to the Service, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include, but is not limited to Personal Data relating to the following categories of data subjects: • Customers, business partners, and vendors of the data exporter (who are natural persons) • Employees or contact persons of data exporter customers, business partners, and vendors • Employees, agents, advisors, contractors, or any user authorized by the data exporter to use the Service (who are natural persons) Categories of data The Personal Data transferred concern the following categories of data (please specify): Data exporter may submit Personal Data to the Service, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include, but is not limited to the following categories of personal data: • First and last name • Business contact information (company, email, phone, physical business address) • Personal contact information (email, cell phone) • Title • Position • Employer • ID data • Professional life data • Personal life data (in the form of security questions and answers) • Connection data • Localization data Special categories of data (if appropriate) The Personal Data transferred concern the following special categories of data (please specify): Data exporter may submit special categories of data to the Service, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include Personal Data concerning health information. Processing operations The Personal Data transferred will be subject to the following basic processing activities (please specify): The objective of Processing of Personal Data by the data importer is the performance of the Service pursuant to the Master Subscription Agreement. DATA EXPORTER Name…….……………………………… Authorised Signature …………………… DATA IMPORTER Name: Xxx Xxxxxx Authorised Signature APPENDIX 2 TO THE STANDARD CONTRACTUAL CLAUSES This Appendix forms part of the Clauses and must be completed and signed by the parties.

TO THE STANDARD CONTRACTUAL CLAUSES. This Appendix forms part of the Clauses and must be completed and signed by the parties. AND EXHIBIT 1 The Member States parties may complete or specifyprovide further details in an Order Form, according to their national procedures, any additional necessary information to be contained in this Appendixif required. Data exporter The data exporter is (please specify briefly your activities relevant to the transfer): The data exporter subscribed to certain SAP Cloud Services which allow its Named Users to enter, amend, use, delete or otherwise process Customer Data exporter is as contemplated under the legal entity that has executed the Data Processing Addendum based on the Standard Contractual Clauses as a Data Exporter established within the European Economic area and Switzerland that have purchased the Service on the basis of one or more Order Form(s)End User Agreement. Data importer The data importer is (please specify briefly activities relevant to the transfer): Data importer, Okta, Inc., is an identity SAP and access management cloud service provider its Subprocessor provide certain Cloud Services which Processes Personal Data, where such data is Customer Data, upon include the instruction hosting of the data exporter in accordance with the terms of the Agreement Service and the Data Processing Addendumprovision of technical support to Customer, its Affiliates and their respective Named Users as contemplated under the End User Agreement. Data subjects The personal data transferred concern the following categories of data subjects (please specify): Data exporter Unless provided otherwise by data exporter, data subjects may submit Personal Data to the Service, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include, but is not limited to Personal Data relating to the following categories of data subjects: • Customers, business partners, and vendors of the data exporter (who are natural persons) • Employees or contact persons of data exporter customers, business partners, and vendors • Employees, agents, advisorsinclude employees, contractors, business partners or any user authorized by other individuals whose personal data is stored in the data exporter to use the Service (who are natural persons) Service. Categories of data The Personal Data personal data transferred concern the following categories of data (please specify): Data exporter may submit Personal Data to Customer determines the categories of data per Service subscribed. Customer’s data fields can be configured as part of the implementation of the Service or as otherwise permitted in the Service, the extent of which is determined and controlled by the . The personal data exporter in its sole discretion, and which may include, but is not limited to transferred usually concern (a subset of) the following categories of personal data: • First and last name • Business contact information (companyname, emailphone numbers, phonee-mail address, physical business address) • Personal contact information (emailtime zone, cell phone) • Title • Position • Employer • ID company name, company address data, plus any application-specific data • Professional life data • Personal life data (in which Customers’ Named Users enter into the form of security questions and answers) • Connection data • Localization data Service. Special categories of data (if appropriate) The Personal Data personal data transferred concern the following special categories of data (please specify): Data exporter may submit special categories of data to the Service, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include Personal Data concerning health information. Not permitted (unless Customer has otherwise notified SAP) Processing operations The Personal Data personal data transferred will be subject to the following basic processing activities (please specify): The objective  use of Processing of Personal Customer Data by the data importer is the performance of to provide the Service pursuant and to provide assistance to technical support  storage of Customer Data in dedicated Service data centers (multi-tenant architecture)  upload any patch, update, upgrade / new releases to the Master Subscription Agreement. DATA EXPORTER Name…….……………………………… Authorised Signature …………………… DATA IMPORTER Name: Xxx Xxxxxx Authorised Signature Service  back up of Customer Data  computer processing of Customer Data, including data transmission, data retrieval, data access  network access to allow Customer Data transfer, if required APPENDIX 2 TO THE STANDARD CONTRACTUAL CLAUSES This Appendix forms part AND EXHIBIT 1 Some Cloud Services are subject to different technical support terms, as set forth in the respective Supplement or Order Form. In all other cases, the description of the Clauses technical and must be completed and signed organizational security measures (TOMs) implemented by the parties.data importer for Customer Data in accordance with Clauses 4(d) and 5(c) shall apply:

TO THE STANDARD CONTRACTUAL CLAUSES. This Appendix forms part of the Standard Contractual Clauses and must be completed and signed by the parties. The Member States may complete or specify, according to their national procedures, any additional necessary information to be contained in this Appendix. Data exporter Exporter The data exporter Data Exporter is (please specify briefly your activities relevant to the transfer): Data exporter Exporter is the legal entity that has executed the Master Agreement with the Data Processing Addendum based on the Standard Contractual Clauses as a Data Exporter established within the European Economic area and Switzerland that have purchased the Service on the basis of one or more Order Form(s)Importer. Data importer Importer The data importer Data Importer is (please specify briefly activities relevant to the transfer): The Data importerImporter is the legal entity that has executed the Master Agreement (with the Data Exporter, Okta, Inc., is an identity and access management cloud service provider which Processes processes Personal Data, where such data is Customer Data, Data upon the instruction of the data exporter Data Exporter in accordance with the terms of the Agreement and the Data Processing AddendumMaster Agreement. Data subjects Subjects The personal data Personal Data transferred concern the following categories of data subjects Data Subjects (please specify): Categories of Data exporter may submit Personal Data to the ServiceSubjects, the extent of which is as determined and controlled by the data exporter in its sole discretionData Exporter, may include Customer representatives and which may include(end) users, but is not limited to Personal Data relating to the following categories of data subjects: • Customerssuch as employees, business partners, and vendors of the data exporter (who are natural persons) • Employees or contact persons of data exporter customers, business partners, and vendors • Employees, agents, advisorsjob applicants, contractors, or any user authorized by collaborators, partners, suppliers and customers of the data exporter to use the Service (who are natural persons) Customer. Categories of data The Personal Data transferred concern the following categories of data (please specify): Data exporter may submit Categories of Personal Data to the ServiceData, the extent of which is as determined and controlled by the data exporter in its sole discretionData Exporter, and which may include, but is not limited to the following categories of among other information, personal data: • First and last name • Business contact information (companysuch as name, emailaddress, phonetelephone or mobile number, physical fax number, email address, and passwords; employment details including employer name, job title and function, and business address) • Personal contact information (email, cell phone) • Title • Position • Employer • ID data • Professional life data • Personal life data (in the form of security questions and answers) • Connection data • Localization data details. Special categories of data (if appropriate) ): The Personal Data transferred concern the following special categories of data (please specify): Data exporter may submit special categories None. Purposes of data to the Service, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include Personal Data concerning health information. transfer / Processing operations The Personal Data transferred will be subject to the following basic processing activities (please specify): The objective of Processing processing of Personal Data by the data importer Data Importer is the performance of the Service Services pursuant to the Master Subscription AgreementAgreement in place between the Data Exporter and the Data Importer. DATA EXPORTER Name…….……………………………… Authorised Signature …………………… DATA IMPORTER Name: Xxx Xxxxxx Authorised Signature APPENDIX 2 TO THE STANDARD CONTRACTUAL CLAUSES This Appendix forms part of the Standard Contractual Clauses and must be completed and signed by the parties. Description of the technical and organisational security measures implemented by the data importer in accordance with Clauses 4(d) and 5(c) (or document/legislation attached): The Data Importer will implement reasonable administrative, physical, managerial and technical controls safeguards for protection of the security, confidentiality and integrity of Personal Data with respect to the Services in accordance with applicable legal requirements, and as set forth in Data Importer’s Section 6 of this Privacy Addendum, and as otherwise agreed by the parties in writing. Data Importer will not materially decrease the overall security of the Services during the term of the Master Agreement.

TO THE STANDARD CONTRACTUAL CLAUSES. This Appendix forms part of the Clauses and must be completed and signed by the parties. AND EXHIBIT 1 The Member States parties may complete or specifyprovide further details in an Order Form, according to their national procedures, any additional necessary information to be contained in this Appendixif required. Data exporter The data exporter is (please specify briefly your activities relevant to the transfer): The data exporter subscribed to certain SAP Cloud Services which allow its Named Users to enter, amend, use, delete or otherwise process Customer Data exporter is as contemplated under the legal entity that has executed the Data Processing Addendum based on the Standard Contractual Clauses as a Data Exporter established within the European Economic area and Switzerland that have purchased the Service on the basis of one or more Order Form(s)End User Agreement. Data importer The data importer is (please specify briefly activities relevant to the transfer): Data importer, Okta, Inc., is an identity SAP and access management cloud service provider its Subprocessor provide certain Cloud Services which Processes Personal Data, where such data is Customer Data, upon include the instruction hosting of the data exporter in accordance with the terms of the Agreement Service and the Data Processing Addendumprovision of technical support to Customer, its Affiliates and their respective Named Users as contemplated under the End User Agreement. Data subjects The personal data transferred concern the following categories of data subjects (please specify): Data exporter Unless provided otherwise by data exporter, data subjects may submit Personal Data to the Service, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include, but is not limited to Personal Data relating to the following categories of data subjects: • Customers, business partners, and vendors of the data exporter (who are natural persons) • Employees or contact persons of data exporter customers, business partners, and vendors • Employees, agents, advisorsinclude employees, contractors, business partners or any user authorized by other individuals whose personal data is stored in the data exporter to use the Service (who are natural persons) Service. Categories of data The Personal Data personal data transferred concern the following categories of data (please specify): Data exporter may submit Personal Data to Customer determines the categories of data per Service subscribed. Customer’s data fields can be configured as part of the implementation of the Service or as otherwise permitted in the Service, the extent of which is determined and controlled by the . The personal data exporter in its sole discretion, and which may include, but is not limited to transferred usually concern (a subset of) the following categories of personal data: • First and last name • Business contact information (companyname, emailphone numbers, phonee-mail address, physical business address) • Personal contact information (emailtime zone, cell phone) • Title • Position • Employer • ID company name, company address data, plus any application-specific data • Professional life data • Personal life data (in which Customers’ Named Users enter into the form of security questions and answers) • Connection data • Localization data Service. Special categories of data (if appropriate) The Personal Data personal data transferred concern the following special categories of data (please specify): Data exporter may submit special categories of data to the Service, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include Personal Data concerning health information. Not permitted (unless Customer has otherwise notified SAP) Processing operations The Personal Data personal data transferred will be subject to the following basic processing activities (please specify): The objective • use of Processing of Personal Customer Data by the data importer is the performance of to provide the Service pursuant and to provide assistance to technical support • storage of Customer Data in dedicated Service data centers (multi-tenant architecture) • upload any patch, update, upgrade / new releases to the Master Subscription Agreement. DATA EXPORTER Name…….……………………………… Authorised Signature …………………… DATA IMPORTER Name: Xxx Xxxxxx Authorised Signature Service • back up of Customer Data • computer processing of Customer Data, including data transmission, data retrieval, data access • network access to allow Customer Data transfer, if required APPENDIX 2 TO THE STANDARD CONTRACTUAL CLAUSES This Appendix forms part AND EXHIBIT 1 Some Cloud Services are subject to different technical support terms, as set forth in the respective Supplement or Order Form. In all other cases, the description of the Clauses technical and must be completed and signed organizational security measures (TOMs) implemented by the parties.data importer for Customer Data in accordance with Clauses 4(d) and 5(c) shall apply:

TO THE STANDARD CONTRACTUAL CLAUSES. This Appendix forms part of the Clauses and must be completed and signed by the partiesClauses. The Member States may complete or specify, according to their national procedures, any additional necessary information to be contained in this Appendix. Capitalized terms used in this Appendix which are otherwise undefined in these Clauses have the meanings given to them in the Data Processing Agreement to which these Clauses are attached. Data exporter The data exporter is (please specify briefly your activities relevant to the transfer): Data The data exporter is the legal entity that has executed the Data Processing Addendum based on the Standard Contractual Clauses as a Data Exporter established within the European Economic area data exporter and Switzerland that have has purchased the Service Services on the basis of one or more Order Form(s). Agreements with either SurveyMonkey Europe UC or SurveyMonkey Inc.. Data importer The data importer is (please specify briefly activities relevant to the transfer): Data importerSurveyMonkey Inc. provides support and sub-processing services to its affiliated entity, OktaSurveyMonkey Europe UC, Inc., which is an identity a provider of online survey and access management cloud service provider which Processes Personal Data, where such survey-related services and data is Customer Data, upon the instruction of the data exporter in accordance with the terms of the Agreement and the Data Processing Addendumcollation services. Data subjects The personal data transferred concern the following categories of data subjects (please specify): Data subjects include:  Natural persons who submit personal data to the data importer via use of the Services (including via online surveys and forms hosted by the data importer on behalf of the data exporter) (“Respondents”).  Natural persons whose personal data may be submitted to the data exporter by Respondents via use of the Services.  Natural persons who are employees, representatives, or other business contacts of the data exporter.  The data exporter’s users who are authorized by the data exporter to access and use the Services. Categories of data The personal data transferred concern the following categories of data (please specify): The data exporter may submit Personal Data personal data to the ServiceServices, and may request for Respondents to submit personal data to the Services, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include, but is not limited to without limitation:  Personal Data relating data of all types that may be submitted by Respondents to the following categories data exporter via user of data subjectsthe Services (such as via surveys). For example: • Customersname, business partnersgeographic location, age, contact details, IP address, profession, gender, financial status, personal preferences, personal shopping or consumer habits, and vendors other preferences and other personal details that the data exporter solicits or desires to collect from its Respondents.  Personal data of all types that the data importer may include in forms and surveys hosted on the Services for the data exporter (who are natural persons) • Employees or such as may be included in survey questions).  Contact and billing details of the data exporter’s employees, authorized end users, and other business contacts. For example: name, title, employer, contact persons information (company, email, phone, address, etc.), payment information, and other account- related data. Special categories of data exporter customers, business partners, and vendors • Employees, agents, advisors, contractors, or any user authorized by the (if appropriate) The personal data exporter to use the Service (who are natural persons) Categories of data The Personal Data transferred concern the following special categories of data (please specify): Data exporter Respondents may submit Personal Data special categories of personal data to the Servicedata exporter via the Services, the extent of which is determined and controlled by the data exporter in its sole discretionexporter. For clarity, and which may include, but is not limited to the following categories of personal data: • First and last name • Business contact information (company, email, phone, physical business address) • Personal contact information (email, cell phone) • Title • Position • Employer • ID data • Professional life data • Personal life data (in the form of security questions and answers) • Connection data • Localization data Special categories of data (if appropriate) The Personal Data transferred concern the following these special categories of data (please specify): Personal Data exporter may submit special categories include information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, and the processing of data to the Service, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include Personal Data concerning health informationor sex life. Processing operations The Personal Data personal data transferred will be subject to the following basic processing activities (please specify): The objective of Processing of processing Personal Data by the data importer is the to support SurveyMonkey Europe UC or SurveyMonkey Inc. (as applicable) in its performance of the Service Services pursuant to the Master Subscription Agreement. DATA EXPORTER Name…….……………………………… Authorised Signature …………………… DATA IMPORTER Name: Xxx Xxxxxx Authorised Signature APPENDIX 2 TO THE STANDARD CONTRACTUAL CLAUSES This Appendix forms part of the Clauses. Capitalized terms used in this Appendix which are otherwise undefined in these Clauses have the meanings given to them in the Data Processing Agreement to which these Clauses are attached. Description of the technical and must be completed and signed organisational security measures implemented by the parties.data importer in accordance with Clauses 4(d) and 5(c) (or document/legislation attached):

TO THE STANDARD CONTRACTUAL CLAUSES. This Appendix 1 forms part of the Clauses and must be completed and signed by the parties. The Member States may complete or specify, according to their national procedures, any additional necessary information to be contained in this AppendixAppendix 1. Data exporter The data exporter is (please specify briefly your activities relevant to the transfer): Data exporter is the authorized legal entity that has executed the Data Processing Addendum based on agreed to the Standard Contractual Clauses as a Data Exporter established within the European Economic area and Switzerland that have purchased the Service on the basis of one or more Order Form(s)data exporter. Data importer The data importer is (please specify briefly activities relevant to the transfer): Data importerA provider of cloud software and data storage services, Okta, Inc., is an identity and access management cloud service provider which Processes Personal Data, where such processes personal data is Customer Data, upon at the instruction of the data exporter in accordance with the terms of the Agreement and the Data Processing AddendumDPA. Data subjects The personal data transferred concern the following categories of data subjects (please specify): Data exporter may submit transfer Personal Data to the Service, the extent of which is determined and Service at its sole discretion as controlled by the data exporter in its sole discretionexporter, and which may include, but is not limited to Personal Data relating to include data regarding the following categories of data subjectscategories: • Customers(1) customers, business partners, vendors, and vendors of the data exporter prospects (who are natural persons); (2) • Employees or contact persons of data exporter customersexporter’s users, business partnerssupporters, prospective users, and vendors • Employeesprospective supporters, agents, advisors, contractors, or any user authorized by the data exporter to use the Service Services (who are natural persons); (3) data exporter’s affiliates, advisors, agents, and freelancers. Categories of data The Personal Data personal data transferred concern the following categories of data (please specify): Data exporter may submit Personal Data to the Service, Service to the extent of which is determined that, under data exporter’s sole discretion and controlled by the data exporter in its sole discretioncontrol, and which may include, but is not limited to include the following categories of personal dataPersonal Data: • ●First and last name • Business contact information (company, email, phone, physical business address) • Personal contact information (email, cell phone) • Title • Position • Employer • ID data • Last Name ●Contact Information ●Professional life data • ●Personal life data (in ●Connection/relationship data ●Locational data ●Event and survey/petition registration, attendance, and response data ●Issue affiliation data ●Internet cookies ●Usage information related to the form of security questions and answers) • Connection data • Localization data Service Special categories of data (if appropriate) The Personal Data personal data transferred concern the following special categories of data (please specify): Data Except where Union or Member State law provide that a data subject may not consent to any of the items in the following list, data exporter may submit special categories of data to the Service, Service to the extent of which is determined that, under data exporter’s sole discretion and controlled by the data exporter in its sole discretioncontrol, and which may include is, for the sake of clarity, Personal Data concerning health informationwith information revealing one or more of the following categories of Personal Data: ●Political party affiliation, participation, voting, contribution, and opinion data ●Religious belief and organization donation data ●Philosophical belief data ●Trade union membership data ●Ethnic data The specified purposes for processing data in the special categories are: to provide the Service to Data Subject in accordance with the Agreement and for improving the Service for all users and customers. Processing operations The Personal Data personal data transferred will be subject to the following basic processing activities (please specify): The objective purpose of Processing of the Personal Data by the data importer is the performance of to provide the Service pursuant to Data Subject in accordance with the Master Subscription Agreement. DATA EXPORTER Name…….……………………………… Authorised Signature …………………… DATA IMPORTER Name: Xxx Xxxxxx Authorised Signature APPENDIX 2 TO THE STANDARD CONTRACTUAL CLAUSES This Appendix forms part of the Clauses and must be completed and signed by the parties.

TO THE STANDARD CONTRACTUAL CLAUSES. This Appendix forms part of the Clauses and must be completed and signed by the parties. The Member States may complete or specify, according to their national procedures, any additional necessary information to be contained in this Appendix. Data exporter The data exporter is (please specify briefly your activities relevant to the transfer): Data exporter is the legal entity that has executed the Data Processing Addendum based on the Standard Contractual these Clauses as a Data Exporter established within data exporter and all Affiliates (as defined in the DPA to which these Clauses are attached) of the data exporter on whose behalf data importer processes personal data of data subjects located in the European Economic area and Area, Switzerland that have purchased or the Service on the basis of one or more Order Form(s)United Kingdom. Data importer The data importer is a provider of cybersecurity products, managed services, and SaaS (please specify briefly activities relevant the “Services”) which may involve processing personal data provided by, and pursuant to the transfer): Data importerinsturctions and directions of, Okta, Inc., is an identity and access management cloud service provider which Processes Personal Data, where such data is Customer Data, upon the instruction of the data exporter in accordance with the terms of athe DPA and services agremment, and all related orders between data exporter and data importer (the Agreement and the Data Processing Addendum“Agreement”). Data subjects The personal data transferred concern the following categories of data subjects (please specify): Data exporter whose personal data may submit Personal Data to be processed in connection with the Service, the extent of which is Services are determined and controlled by the data exporter in its sole discretion, discretion and which may include, include but is are not limited to Personal Data relating to the following categories of data subjectsto: • Customers, business partners, employees and vendors contractors of the data exporter (who are natural persons) • Employees or contact persons exporter, and employees and contractors of the data exporter exporters customers, business suppliers and partners, and vendors • Employees, agents, advisors, contractors, or any user authorized by the data exporter to use the Service (who are natural persons) . Categories of data The Personal Data transferred concern the following categories of personal data may include but are not limited to:  Business contact information, including name, business role, professional title, business contact information (please specify): Data exporter may submit Personal Data to the Serviceaddress, the extent phone number, fax number, email address);  Electronic identification and access credentials for business-managed assets, including IP address, user name, password;  Log data, configuration data and diagnostic output of which is business-managed assets; and  Other categories of personal data determined and controlled by the data exporter in its sole discretion, and which may include, but is not limited to the following categories of personal data: • First and last name • Business contact information (company, email, phone, physical business address) • Personal contact information (email, cell phone) • Title • Position • Employer • ID data • Professional life data • Personal life data (in the form of security questions and answers) • Connection data • Localization data . Special categories of data (if appropriate) The Personal Data transferred concern the following Parties do not intend that special categories of data (please specify): shall be processed under the Agreement. Processing operations Data exporter may submit special categories of importer will process personal data as necessary to perform the Services pursuant to the Service, Agreement and to comply with the extent of Applicable Data Protection Law and other laws to which is determined and controlled by the data exporter and data importer may be subject. Such processing operations may include collecting, recording, organizing, storage, use, alteration, disclosure, transmission, combining, tretireval, consultation, archiving and/or destruction. Processing may be performed in its sole discretionthe European Economic Area, Switzerland, United Kingdom, United States, and which may include Personal Data concerning health information. Processing operations The Personal Data transferred will be subject to the following basic processing activities (please specify): The objective of Processing of Personal Data by the such other countries where data importer is Affiliates or Sub-Processors are located, in accordance with these Clauses and the performance of the Service pursuant to the Master Subscription Agreement. DATA EXPORTER Name…….……………………………… Authorised Signature …………………… Printed Name: TRIPWIRE INTERNAL AND PARTNER CONFIDENTIAL—DO NOT DISTRIBUTE DATA IMPORTER Tripwire, Inc. TRIPWIRE INTERNAL AND PARTNER CONFIDENTIAL—DO NOT DISTRIBUTE Authorised Signature Printed Name: Xxx Xxxxxx Authorised Signature Xxxxxxxx APPENDIX 2 TO THE STANDARD CONTRACTUAL CLAUSES This Appendix forms part of the Clauses and must be completed and signed by the parties.. Data importer will, as a minimum, implement the security measures described in Exhibit 1 to the DPA to which these Clauses are attached. DATA EXPORTER Authorised Signature Printed Name: DATA IMPORTER Tripwire, Inc. TRIPWIRE INTERNAL AND PARTNER CONFIDENTIAL—DO NOT DISTRIBUTE

TO THE STANDARD CONTRACTUAL CLAUSES. This Appendix forms part of the Clauses and must be completed and signed by the parties. The Member States may complete or specify, according to their national procedures, any additional necessary information to be contained in this Appendix. Data exporter The data exporter is (please specify briefly your activities relevant to the transfer): Data exporter is the legal entity that has executed the Data Processing Addendum based on the Standard Contractual Clauses as a Data Exporter established within the European Economic area and Switzerland that have purchased the Service on the basis of one or more Order Form(s)Customer identified above. Data importer The data importer is (please specify briefly activities relevant to the transfer): Data importeris: APTTUS Corporation, Okta0000 Xxxxxxx Xxxxxx Xxxx, Inc.Xxxxx 000, is an identity and access management cloud service provider which Processes Personal DataXxx Xxxxx, where such data is Customer Data, upon the instruction of the data exporter in accordance with the terms of the Agreement and the Data Processing AddendumXX 00000. Data subjects The personal data transferred concern the following categories of data subjects (please specify): subjects: Data exporter may submit Personal Data to the ServiceServices, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include, but is not limited to Personal Data relating to the following categories of data subjects: • Customers Prospects, customers, business partners, partners and vendors of the data exporter (who are natural persons) •  Employees or contact persons of data exporter exporter’s prospects, customers, business partners, partners and vendors •  Employees, agents, advisors, contractors, or any user authorized by the freelancers of data exporter to use the Service (who are natural persons)  Data exporter’s Users authorized by data exporter to use the Services. Categories of data The Personal Data personal data transferred concern the following categories of data (please specify): data: Data exporter may submit Personal Data to the ServiceServices, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include, but is not limited to the following categories of personal dataPersonal Data: •  First and last name • Business contact  Title  Position  Employer  Contact information (company, email, phone, physical business address) • Personal contact information (email, cell phone) • Title • Position • Employer •  ID data •  Professional life data •  Personal life data (in the form of security questions and answers) •  Connection data • Localization  Loaclisation data Special categories of data (if appropriate) The Personal Data personal data transferred concern the following special categories of data (please specify): Data exporter may submit special categories of data to the Service, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include Personal Data concerning health informationdata: Not applicable. Processing operations The Personal Data personal data transferred will be subject to the following basic processing activities (please specify): activities: The objective of Processing of Personal Data by the data importer is the performance of the Service Services pursuant to the Master Subscription Agreement. DATA EXPORTER Name…….:……………………………… Authorised Signature …………………… DATA IMPORTER Name: Xxx Xxxxxx Xxxxxxx Xxxxxxxx Authorised Signature …………………… APPENDIX 2 TO THE STANDARD CONTRACTUAL CLAUSES This Appendix forms part of the Clauses and must be completed and signed by the parties.. Description of the technical and organisational security measures implemented by the data importer in accordance with Clauses 4(d) and 5(c):

TO THE STANDARD CONTRACTUAL CLAUSES. This Appendix forms part of the Clauses and must be completed and signed by the parties. The Member States may complete or specify, according to their national procedures, any additional necessary information to be contained in this Appendix. Data exporter The data exporter is (please specify briefly your activities relevant to the transfer): Data exporter is the legal entity that has executed the Data Processing Addendum based on the Standard Contractual these Clauses as a Data Exporter established within data exporter and all Affiliates (as defined in the DPA to which these Clauses are attached) of the data exporter on whose behalf data importer processes personal data of data subjects located in the European Economic area and Area, Switzerland that have purchased or the Service on the basis of one or more Order Form(s)United Kingdom. Data importer The data importer is a provider of automated data scanning services (please specify briefly activities relevant the “Services”) which may involve processing personal data provided by, and pursuant to the transfer): Data importerinsturctions and directions of, Okta, Inc., is an identity and access management cloud service provider which Processes Personal Data, where such data is Customer Data, upon the instruction of the data exporter in accordance with the terms of athe DPA and services agremment, and all related orders between data exporter and data importer (the Agreement and the Data Processing Addendum“Agreement”). Data subjects The personal data transferred concern the following categories of data subjects (please specify): Data exporter whose personal data may submit Personal Data to be processed in connection with the Service, the extent of which is Services are determined and controlled by the data exporter in its sole discretion, discretion and which may include, include but is are not limited to Personal Data relating to the following categories of data subjectsto: • Customers, business partners, employees and vendors contractors of the data exporter (who are natural persons) • Employees or contact persons exporter, and employees and contractors of the data exporter exporters customers, business suppliers and partners, and vendors • Employees, agents, advisors, contractors, or any user authorized by the data exporter to use the Service (who are natural persons) . Categories of data The Personal Data transferred concern the following categories of personal data may include but are not limited to: Business contact information, including name, business role, professional title, business contact information (please specify): Data exporter may submit Personal Data to the Serviceaddress, the extent phone number, fax number, email address); Electronic identification and access credentials for business-managed assets, including IP address, user name, password; Log data, configuration data and diagnostic output of which is business-managed assets; and Other categories of personal data determined and controlled by the data exporter in its sole discretion, and which may include, but is not limited to the following categories of personal data: • First and last name • Business contact information (company, email, phone, physical business address) • Personal contact information (email, cell phone) • Title • Position • Employer • ID data • Professional life data • Personal life data (in the form of security questions and answers) • Connection data • Localization data . Special categories of data (if appropriate) The Personal Data transferred concern the following Parties do not intend that special categories of data (please specify): shall be processed under the Agreement. Processing operations Data exporter may submit special categories of importer will process personal data as necessary to perform the Services pursuant to the Service, Agreement and to comply with the extent of Applicable Data Protection Law and other laws to which is determined and controlled by the data exporter and data importer may be subject. Such processing operations may include collecting, recording, organizing, storage, use, alteration, disclosure, transmission, combining, tretireval, consultation, archiving and/or destruction. Processing may be performed in its sole discretionthe European Economic Area, Switzerland, United Kingdom, United States, and which may include Personal Data concerning health information. Processing operations The Personal Data transferred will be subject to the following basic processing activities (please specify): The objective of Processing of Personal Data by the such other countries where data importer is Affiliates or Sub-Processors are located, in accordance with these Clauses and the performance of the Service pursuant to the Master Subscription Agreement. DATA EXPORTER Name…….……………………………… Authorised Signature …………………… Printed Name: DATA IMPORTER Tripwire, Inc. Authorised Signature Printed Name: Xxx Xxxxxx Authorised Signature Xxxxxxxx APPENDIX 2 TO THE STANDARD CONTRACTUAL CLAUSES This Appendix forms part of the Clauses and must be completed and signed by the parties. Data importer will, as a minimum, implement the security measures described in Exhibit 1 to the DPA to which these Clauses are attached. DATA EXPORTER Authorised Signature Printed Name: DATA IMPORTER Tripwire, Inc. Authorised Signature Printed Name: Xxxxxx Xxxxxxxx 1 Parties may reproduce definitions and meanings contained in Directive 95/46/EC within this Clause if they considered it better for the contract to stand alone.

TO THE STANDARD CONTRACTUAL CLAUSES. This Appendix forms part of the Clauses and must be completed and signed by the parties. The Member States may complete or specify, according to their national procedures, any additional necessary information to be contained in this Appendix. Data exporter The data exporter is (please specify briefly your activities relevant to the transfer): Data exporter is the legal entity that has executed the Data Processing Addendum based on the Standard Contractual Clauses as a Data Exporter established within the European Economic area and Switzerland that have purchased the Service on the basis of one or more Order Form(sOrder(s). Data importer The data importer is (please specify briefly activities relevant to the transfer): Data importer, OktaPasswordBoss, Inc.LLC, is an identity and access password management cloud service provider which Processes Personal Data, where such data is Customer Company Data, upon the instruction of the data exporter in accordance with the terms of the Agreement and the Data Processing Addendum. Data subjects The personal data transferred concern the following categories of data subjects (please specify): Data exporter may submit Personal Data to the Service, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include, but is not limited to Personal Data relating to the following categories of data subjects: • CustomersCompany’s, business partners, and vendors of the data exporter (who are natural persons) • Employees or contact persons of data exporter customerscustomer’s, business partners, and vendors • Employees, agents, advisors, contractors, or any user authorized by the data exporter to use the Service (who are natural persons) Categories of data The Personal Data transferred concern the following categories of data (please specify): Data exporter may submit Personal Data to the Service, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include, but is not limited to the following categories of personal data: • First and last name • Business contact information (company, email, phone, physical business address) • Personal contact information (email, cell phone) • Title • Position • Employer • ID data • Professional life data • Personal life data (in the form of security questions and answers) • Connection data • Localization data Special categories of data (if appropriate) The Personal Data transferred concern the following special categories of data (please specify): Data exporter may submit special categories of data to the Service, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include Personal Data concerning health information. Processing operations The Personal Data transferred will be subject to the following basic processing activities (please specify): The objective of Processing of Personal Data by the data importer is the performance of the Service pursuant to the Master Subscription Agreement. DATA EXPORTER Name…….……………………………… Authorised Signature …………………… DATA IMPORTER EXPORTER: Name: Xxx Xxxxxx Authorised Signature APPENDIX 2 TO THE STANDARD CONTRACTUAL CLAUSES This Appendix forms part of the Clauses and must be completed and signed by the parties.Signature: DATA IMPORTER: Name: Xxxxx Xxxx, CEO Authorised Signature:

TO THE STANDARD CONTRACTUAL CLAUSES. This Appendix forms part of the Clauses and must be completed and signed by the parties. parties The Member States may complete or specify, according to their national procedures, any additional necessary information to be contained in this Appendix. Data exporter The data exporter is (please specify briefly your activities relevant to the transfer): Data exporter Exporter is the legal entity that has executed specified in Section 2.1 of Schedule 1 of the Data Processing Addendum based on the Standard Contractual Clauses as a Data Exporter established within the European Economic area and Switzerland that have purchased the Service on the basis of one or more Order Form(s)DPA. Data importer The data importer is (please specify briefly activities relevant to the transfer): Data importerXxxxxxxxxx.xxx, Okta, Inc., inc. is an identity and access management a provider of enterprise cloud service provider computing solutions which Processes Personal Data, where such processes personal data is Customer Data, upon the instruction of the data exporter in accordance with the terms of the Agreement and the Data Processing AddendumAgreement. Data subjects The personal data transferred concern the following categories of data subjects (please specify): Data exporter may submit Personal Data to the ServiceSCC Services, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include, but is not limited to Personal Data relating to the following categories of data subjects: • Customers● Prospects, customers, business partners, partners and vendors of the data exporter (who are natural persons) • ● Employees or contact persons of data exporter exporter’s prospects, customers, business partners, partners and vendors • ● Employees, agents, advisors, contractors, or any user authorized by the freelancers of data exporter to use the Service (who are natural persons) ● Data exporter’s Users authorized by data exporter to use the SCC Services Categories of data The Personal Data personal data transferred concern the following categories of data (please specify): Data exporter may submit Personal Data to the ServiceSCC Services, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include, but is not limited to the following categories of personal dataPersonal Data: • ● First and last name • Business contact ● Title ● Position ● Employer ● Contact information (company, email, phone, physical business address) • Personal contact information (email, cell phone) • Title • Position • Employer • ● ID data • ● Professional life data • ● Personal life data (in the form of security questions and answers) • Connection data • Localization ● Localisation data Special categories of data (if appropriate) The Personal Data personal data transferred concern the following special categories of data (please specify): Data exporter may submit special categories of data to the ServiceSCC Services, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include is for the sake of clarity Personal Data with information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade-union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health informationor data concerning a natural person’s sex life or sexual orientation. Processing operations The Personal Data personal data transferred will be subject to the following basic processing activities (please specify): The objective of Processing of Personal Data by the data importer is the performance of the Service SCC Services pursuant to the Master Subscription Agreement. DATA EXPORTER Name…….:………………………………… …….… Authorised Signature …………………… DATA IMPORTER Xxxxx Xxxxxxx Name: Xxx Xxxxxx :………………………………….… Authorised Signature APPENDIX 2 TO THE STANDARD CONTRACTUAL CLAUSES This Appendix forms part of the Clauses and must be completed and signed by the parties.……………………

TO THE STANDARD CONTRACTUAL CLAUSES. This Appendix forms part of the Clauses and must be completed and signed by the parties. The Member States may complete or specify, according to their national procedures, any additional necessary information to be contained in this Appendix. Data exporter The data exporter is (please specify briefly your activities relevant to the transfer): Data exporter Exporter is (i) the legal entity that has executed the Data Processing Addendum based on the Standard Contractual Clauses as a Data Exporter and, (ii) all Affiliates (as defined in the Agreement) of Customer established within the European Economic area Area (EEA) and Switzerland that have purchased the Service SCC Services on the basis of one or more Order Form(s). Data importer The data importer is (please specify briefly activities relevant to the transfer): Data importerImagineer Technology Group, Okta, Inc., LLC is an identity and access management a provider of enterprise cloud service provider computing solutions which Processes Personal Data, where such processes personal data is Customer Data, upon the instruction of the data exporter in accordance with the terms of the Agreement and the Data Processing AddendumAgreement. Data subjects The personal data transferred concern the following categories of data subjects (please specify): Data exporter may submit Personal Data to the ServiceSCC Services, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include, but is not limited to Personal Data relating to the following categories of data subjects: • CustomersProspects, customers, business partners, partners and vendors of the data exporter (who are natural persons) • Employees or contact persons of data exporter exporter’s prospects, customers, business partners, partners and vendors • Employees, agents, advisors, contractors, or any user authorized by the freelancers of data exporter to use the Service (who are natural persons) • Data exporter’s Users authorized by data exporter to use the SCC Services Categories of data The Personal Data personal data transferred concern the following categories of data (please specify): Data exporter may submit Personal Data to the ServiceSCC Services, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include, but is not limited to the following categories of personal dataPersonal Data: • First and last name • Business contact Title • Position • Employer • Contact information (company, email, phone, physical business address) • Personal contact information (email, cell phone) • Title • Position • Employer • ID Identification data • Professional life data • Personal life data (in the form of security questions and answers) • Connection data • Localization data • Photographs Special categories of data (if appropriate) The Personal Data personal data transferred concern the following special categories of data (please specify): Data exporter may submit special categories of data to the ServiceSCC Services, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include is for the sake of clarity Personal Data with information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, and the processing of data concerning health informationor sex life. Processing operations The Personal Data personal data transferred will be subject to the following basic processing activities (please specify): The objective of Processing of Personal Data by the data importer is the performance of the Service SCC Services pursuant to the Master Subscription Agreement. DATA EXPORTER Name…….……………………………… : Authorised Signature …………………… Signature: DATA IMPORTER Name: Xxx Xxxxxx Xxxx Xxxx Authorised Signature APPENDIX 2 TO THE STANDARD CONTRACTUAL CLAUSES This Appendix forms part of the Clauses and must be completed and signed by the parties.Signature:

TO THE STANDARD CONTRACTUAL CLAUSES. This Appendix Exhibit forms part of the Clauses and must be completed and signed by the parties. The Member States may complete or specify, according to their national procedures, any additional necessary information to be contained in this AppendixExhibit. Data exporter The data exporter is: Data Exporter is (please specify briefly your activities relevant to the transfer): Data exporter is i) the legal entity that has executed the Data Processing Addendum based on the Standard Contractual Clauses as a Data Exporter and, (ii) all Affiliates (as defined in the Addendum) of the Customer established within the European Economic area and Switzerland Area (EEA) or the UK that have purchased the Service Bold Commerce Services on the basis of one or more Order Form(s). Data importer The data importer is (please specify briefly activities relevant to the transfer): Data importeris: Bold Commerce, Okta, Inc., is an identity and access management cloud service provider which Processes Personal Data, where such data is Customer Data, upon the instruction of the data exporter in accordance with the terms of the Agreement and the Data Processing Addendum. Inc. Data subjects The personal data transferred concern the following categories of data subjects (please specify): Data exporter may submit Personal Data to the Service, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include, but is not limited to Personal Data relating to the following categories of data subjects: • Customers, business partners, Consumers and vendors customers of the data exporter Customer (who are natural persons) • Employees or contact persons of data exporter customers, business partners), and vendors • Employeesemployees, agents, advisors, contractors, or any user authorized by advisors and consultants of the data exporter to use the Service Customer (who are natural persons) ). Categories of data The Personal Data personal data transferred concern the following categories of data data: Name, email address, billing address and shipping address (please specify): Data exporter may submit Personal Data to the Servicestreet address, the extent of which is determined and controlled by the data exporter in its sole discretioncity, state/province, country, zip/postal code), phone number, user ID/credentials, transaction data, IP address/device information, and which may include, but is not limited to the following categories of personal location data: • First and last name • Business contact information (company, email, phone, physical business address) • Personal contact information (email, cell phone) • Title • Position • Employer • ID data • Professional life data • Personal life data (in the form of security questions and answers) • Connection data • Localization data . Special categories of data (if appropriate) The Personal Data personal data transferred concern the following special categories of data (please specify): Data exporter may submit special categories of data to the Service, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include Personal Data concerning health information. data: N/A DocuSign Envelope ID: 75EC5D42-26EF-4217-9E2B-659D216530AC Version – June 2021 18 Processing operations The Personal Data personal data transferred will be subject to the following basic processing activities: The personal data transferred will be transferred in order to fulfil the objectives of the Services Agreement, and will be subject to the following basic processing activities: -facilitating the sales activities (please specify): The objective of Processing the Customer through various online ecommerce platforms - automated processing on behalf of the Customer and the e-commerce platforms it subscribes to or uses, including the provision and modification/formatting of Personal Data -automated processing on behalf of the Customer to transfer Personal Data to an authorized sub processor -accessing Personal Data of Data Subjects specific to the Customer’s transactions to assist in custom reporting or support/customer service requests made by the data importer is Customer -facilitating the performance viewing, editing, and deletion of the Service pursuant Personal Data of Data Subjects specific to the Master Subscription Agreement. Customer by the Customer -facilitating the intake of Personal Data, and the viewing, editing, and deletion of Personal Data specific to a Data Subject by that Data Subject -facilitating payment transactions between Data Subject and the payment gateway(s) and sub merchants selected by the Customer DATA EXPORTER Name…….: ……………………………………………… Authorised Signature ……………………………………………… DATA IMPORTER Name: Xxx Xxxxxx Xxxxxxxxxx Authorised Signature APPENDIX 2 TO THE STANDARD CONTRACTUAL CLAUSES This Appendix forms part of the Clauses and must be completed and signed by the parties.……………………………………………… Version – June 2021 19 DocuSign Envelope ID: 75EC5D42-26EF-4217-9E2B-659D216530AC

TO THE STANDARD CONTRACTUAL CLAUSES. This Appendix forms part of the Clauses and must be completed and signed by the parties. parties The Member States may complete or specify, according to their national procedures, any additional necessary information to be contained in this Appendix. Data exporter The data exporter is: Data Exporter is (please specify briefly your activities relevant to the transfer): Data exporter is i) the legal entity that has executed the Data Processing Addendum based on the Standard Contractual Clauses as a Data Exporter and, (ii) all Company Affiliates established within the European Economic area Area (EEA) and Switzerland that have purchased the Service on the basis of one or more Order Form(s)Services. Data importer The data importer is: Xxxx Corporation is (please specify briefly activities relevant to the transfer): Data importer, Okta, Inc., is an identity a provider of online business services and access management cloud service provider tools which Processes Personal Data, where such processes personal data is Customer Data, upon the instruction of the data exporter in accordance with the terms of the Principal Agreement and the Data Processing this Addendum. Data subjects The personal data transferred concern the following categories of data subjects (please specify): Data exporter Company may submit Personal Data to the ServiceServices, the extent of which is determined and controlled by the data exporter Company in its sole discretion, and which may include, but is not limited to Personal Data relating to the following categories of data subjects: • Customers● Leads, customers, business partners, and vendors of the data exporter Company (who are natural persons) • ● Employees or contact persons of data exporter Company's leads, customers, business partners, and vendors • ● Employees, agents, advisors, contractors, or any user authorized by the data exporter to use the Service freelancers of Company (who are natural persons) ● Company's Users authorized by Company to use the Service Categories of data The Personal Data personal data transferred concern the following categories of data: Company, its Users, and the Data Subject may submit Company Personal Data to the Services, the extent of which is determined and controlled by Company in its sole discretion, and which may include, but is not limited to the following categories of Personal Data: ● First and last name ● Title ● Position ● Employer ● Contact information (company, email, phone, physical address) ● ID data ● Professional life data ● Personal life data ● Connection data ● Localization data ● Legal instruments ● Email data Special categories of data (please specify): if appropriate) The personal data transferred concern the following special categories of data: Data exporter may submit Personal Data special categories of data to the ServiceServices, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may includeis for the sake of clarity Personal Data with information revealing racial or ethnic origin, but is not limited to political opinions, religious or philosophical beliefs, trade-union membership, and the following categories of personal data: • First and last name • Business contact information (company, email, phone, physical business address) • Personal contact information (email, cell phone) • Title • Position • Employer • ID data • Professional life data • Personal life data (in the form of security questions and answers) • Connection data • Localization data Special categories processing of data (if appropriate) The Personal Data transferred concern the following special categories of data (please specify): Data exporter may submit special categories of data to the Service, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include Personal Data concerning health informationor sex life. Processing operations The Personal Data personal data transferred will be subject to the following basic processing activities (please specify): activities: The objective of Processing of Company Personal Data by the data importer is the performance of the Service Services pursuant to the Master Subscription AgreementPrincipal Agreement and this Addendum. DATA EXPORTER Name…….:……………………………… Authorised Signature …………………… DATA IMPORTER Name: Xxx Xxxxxx Xxxxxxxxxx, CEO Authorised Signature APPENDIX 2 TO THE STANDARD CONTRACTUAL CLAUSES This Appendix forms part of the Clauses and must be completed and signed by the parties.Signature:

TO THE STANDARD CONTRACTUAL CLAUSES. This Appendix forms part of the Clauses and must be completed and signed by the parties. parties The Member States may complete or specify, according to their national procedures, any additional necessary information to be contained in this Appendix. Data exporter The data exporter (as such term is applied mutatis mutandis per Section 10.1.2 of the DPA to Reseller as applicable in its role as processor) is (please specify briefly your activities relevant to the transfer): Data exporter Reseller is the a legal entity that has executed resells the Data Processing Addendum based on the Standard Contractual Clauses as a Data Exporter SCC Services to customers established within the European Economic area and Area or Switzerland that have purchased the Service on the basis of one or more Order Form(s). (each a Data Exporter Controller as defined above) Data importer The data importer (as such term is applied mutatis mutandis per Section 10.1.2 of the DPA to sxxxxxxxxx.xxx, inc. as applicable in its role as sub-processor) is (please specify briefly activities relevant to the transfer): Data importerSxxxxxxxxx.xxx, Okta, Inc., inc. is an identity and access management a provider of enterprise cloud service provider computing solutions which Processes Personal Data, where such processes personal data is Customer Data, upon the instruction as sub-processor on behalf of the data exporter Data Exporter Controller in accordance with the terms of the Agreement and the Data Processing AddendumAgreement. Data subjects The personal data transferred concern the following categories of data subjects (please specify): The Data exporter Exporter Controller and/or Reseller may submit Personal Data to the ServiceSCC Services, the extent of which is determined and controlled by the data exporter Data Exporter Controller and/or Reseller in its their sole discretion, and which may include, but is not limited to Personal Data relating to the following categories of data subjects: • Customers· Prospects, customers, business partners, partners and vendors of the data exporter (who are natural personsData Exporter Controller) • · Employees or contact persons of data exporter Data Exporter Controller’s prospects, customers, business partners, partners and vendors • · Employees, agents, advisors, contractors, or any user freelancers of Data Exporter Controller · Data Exporter Controller’s Users authorized by the data exporter Data Exporter Controller to use the Service (who are natural persons) SCC Services · Doctors and other medical professionals and employees or contact persons of Reseller Customer Categories of data The Personal Data personal data transferred concern the following categories of data (please specify): Data exporter Exporter Controller and/or Reseller may submit Personal Data to the ServiceSCC Services, the extent of which is determined and controlled by the data exporter Data Exporter Controller and/or Reseller in its their sole discretion, and which may include, but is not limited to the following categories of personal dataPersonal Data: • · First and last name • Business contact · Title · Position · Employer · Contact information (company, email, phone, physical business address) • Personal contact information (email, cell phone) • Title • Position • Employer • · ID data • (20 November 2015_B (RESELLER)) · Professional life data • (medical specialty, license details) · Personal life data (in the form of security questions and answers) • · Connection data • Localization · Localisation data Special categories of data (if appropriate) The Personal Data personal data transferred concern the following special categories of data (please specify): Data exporter Exporter Controller and/or Reseller may submit special categories of data to the ServiceSCC Services, the extent of which is determined and controlled by the data exporter Data Exporter Controller and/or Reseller in its their sole discretion, and which may include is for the sake of clarity Personal Data with information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, and the processing of data concerning health informationor sex life. Processing operations The Personal Data personal data transferred will be subject to the following basic processing activities (please specify): The objective of Processing of Personal Data by the data importer sxxxxxxxxx.xxx, inc. is the performance of the Service SCC Services pursuant to the Master Subscription Agreement. DATA EXPORTER Name…….……………………………… Authorised Signature …………………… DATA IMPORTER Name: Xxx Xxxxxx Authorised Signature APPENDIX 2 TO THE STANDARD CONTRACTUAL CLAUSES This Appendix forms part of the Clauses and must be completed and signed by the parties.(20 November 2015_B (RESELLER))

TO THE STANDARD CONTRACTUAL CLAUSES. This Appendix forms part of the Clauses and must be completed and signed by the parties. The Member States may complete or specify, according to their national procedures, any additional necessary information to be contained in this Appendix. Data exporter The data exporter is (please specify briefly your activities relevant to the transfer): Data The data exporter is (i) the legal entity that has executed the Data Processing Addendum based on the attached Standard Contractual Clauses as a Data Exporter data exporter, and (ii) all Affiliates of Customer established within the European Economic area Area (EEA) and Switzerland that have purchased the Service SCC Services on the basis of one or more Order Form(s)Forms or are using SCC Services in accordance with the Agreement. The terms “Affiliate,” “Customer” and “Order Form” are defined in the Agreement, and the terms “Agreement” and “SCC Services” are defined in the attached DPA. Data importer The data importer is (please specify briefly activities relevant to the transfer): Data importerXxxxxxxxxXxxxx.xxx, Okta, Inc., inc. is an identity and access management a provider of enterprise cloud service provider computing solutions which Processes Personal Data, where such processes personal data is Customer Data, upon the instruction of the data exporter in accordance with the terms of the Agreement and the Data Processing AddendumAgreement. Data subjects The personal data transferred concern the following categories of data subjects (please specify): Data exporter may submit Personal Data to the ServiceSCC Services, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include, but is not limited to Personal Data relating to the following categories of data subjects: • Customers● Prospects, customers, business partners, partners and vendors of the data exporter (who are natural persons) • ● Employees or contact persons of data exporter exporters’ prospects, customers, business partners, partners and vendors • ● Employees, agents, advisors, contractors, or any user authorized by the freelancers of data exporter to use the Service (who are natural persons) ● Data exporter’s Users authorised by data exporter to use the SCC Services Categories of data The Personal Data personal data transferred concern the following categories of data (please specify): Data exporter may submit Personal Data to the ServiceSCC Services, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include, but is not limited to the following categories of personal dataPersonal Data: • ● First and last name • Business contact ● Title ● Position ● Employer ● Contact information (company, email, phone, physical business address) • Personal contact information (email, cell phone) • Title • Position • Employer • ● ID data • Professional ● professional life data • Personal ● personal life data (in the form of security questions and answers) • Connection ● connection data • Localization ● localisation data Special categories of data (if appropriate) The Personal Data personal data transferred concern the following special categories of data (please specify): Data exporter may submit special categories of data to the ServiceSCC Services, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include is for the sake of clarity Personal Data with information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade- union membership, and the processing of data concerning health informationor sex life. Processing operations The Personal Data personal data transferred will be subject to the following basic processing activities (please specify): The objective of Processing of Personal Data by the data importer is the performance of the Service SCC Services pursuant to the Master Subscription Agreement. DATA EXPORTER Name…….……………………………… :  Authorised Signature  DATA IMPORTER Name: Xxxxxx Xxxxx Authorised Signature ……………………… DATA IMPORTER Name: Xxx Xxxxxx Authorised Signature APPENDIX 2 TO THE STANDARD CONTRACTUAL CLAUSES This Appendix forms part of the Clauses and must be completed and signed by the parties.……..

TO THE STANDARD CONTRACTUAL CLAUSES. This Appendix forms part of the Clauses and must be completed and signed by the partiesService Subscription Agreement dated . The Member States may complete or specify, according to their national procedures, any additional necessary information to be contained in this Appendix. Data exporter Exporter The data exporter Data Exporter is (please specify briefly your activities relevant to the transfer): Data exporter Exporter is the legal entity that has executed the Data Processing Addendum based on the Standard Contractual Clauses as a Data Exporter (Subscriber as defined in the Agreement) established within the [European Economic area Area (EEA)] and Switzerland [Switzerland] that have purchased the Service on the basis of one or more Order Form(s)OneLogin Services. Data importer Importer The data importer Data Importer is (please specify briefly activities relevant to the transfer): Data importerOneLogin, Okta, Inc., Inc. is an a provider of a cloud identity and access management cloud service provider solution which Processes Personal Data, where such processes personal data is Customer Data, upon the instruction of the data exporter in accordance with the terms of the Agreement and the Data Processing AddendumAgreement. Data subjects The personal data transferred concern the following categories of data subjects (please specify): Data exporter Exporter may submit Personal Data personal data to the ServiceOneLogin Services, the extent of which is determined and controlled by the data exporter Data Exporter in its sole discretion, and which may includeincludes, but is not limited to Personal Data personal data relating to the following categories of data subjects: • CustomersProspects, business partners, and vendors of the data exporter (who are natural persons) • Employees or contact persons of data exporter customers, business partners, and vendors resellers • EmployeesEmployees or contractors of prospects, agentscustomers, advisors, contractorsbusiness partners, or any user resellers • Data Exporter’s Users authorized by the data exporter Data Exporter to use the Service (who are natural persons) OneLogin Services Categories of data The Personal Data personal data transferred concern the following categories of data (please specify): Data exporter Exporter may submit Personal Data personal data to the ServiceOneLogin Services, the extent of which is determined and controlled by the data exporter in its Data Exporter at their sole discretion, and which may includeincludes, but is not limited to the following categories of personal data: • First name and last name • Business contact Contact information (company, email, phone, physical business address) • Personal contact information (email, cell phone) • Title • Position • Employer • ID data • Professional life data • Personal life data (in the form of security questions and answers) • Connection data • Localization Localisation data Special categories of data (if appropriate) The Personal Data personal data transferred concern the following special categories of data (please specify): Data exporter may submit special categories of data to the Service, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include Personal Data concerning health informationNone. Processing operations The Personal Data personal data transferred will be subject to the following basic processing activities (please specify): The objective of Processing of Personal Data by the data importer is the performance of the Service pursuant to the Master Subscription Agreement. DATA EXPORTER Name…….……………………………… Authorised Signature …………………… DATA IMPORTER Name: Xxx Xxxxxx Authorised Signature APPENDIX 2 TO THE STANDARD CONTRACTUAL CLAUSES This Appendix forms part of the Clauses and must be completed and signed by the parties.):

TO THE STANDARD CONTRACTUAL CLAUSES. This Appendix forms part of the Clauses and must be completed and signed by the parties. parties The Member States may complete or specify, according to their national procedures, any additional necessary information to be contained in this Appendix. Appendix Data exporter The data exporter is (please specify briefly your activities relevant to the transfer): Data The data exporter is will export the legal entity that has executed personal data contained in the Data Processing Addendum based on client’s documentation to the Standard Contractual Clauses as a Data Exporter established within responders via the European Economic area and Switzerland that have purchased Xxxxxxxxxxxx.xxx platform. Exported data will concern personal data of data exporter’s employees with access given to the Service on online platform handled by the basis data importer. Also, data exporter’s client data for the purposes of one or more Order Form(s)forwarding data exporter’s audit requests to responders by the data importer. Data importer The data importer is (please specify briefly activities relevant to the transfer): Data importerCapital Confirmation Inc. The data importer provides an online venue for digital transaction management, Oktaincluding but not limited to, Inc.audit confirmations, is an identity accounts receivable/accounts payable confirmations, credit inquiries, employee benefit plan audits and access management cloud service provider confirmations, and legal confirmations for accounting firms, law firms, banks, and other users. Processed data will concern data exporter’s employees for which Processes Personal Data, where such data is Customer Data, upon accounts in the instruction of platform handled by the data exporter in accordance with importer will be created. Also, data exporter’s client data for the terms purposes of forwarding data exporter’s audit requests to responders by the Agreement and the Data Processing Addendumdata importer. Data subjects The personal data transferred concern the following categories of data subjects (please specify): Data exporter may submit Personal Data exporter’s employees and personal data of data exporter’s client’s representatives and other subjects mentioned in the documentation, which is sent to the Service, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include, but is not limited to Personal Data relating to the following categories of data subjects: • Customers, business partners, and vendors of the data exporter (who are natural persons) • Employees or contact persons of data exporter customers, business partners, and vendors • Employees, agents, advisors, contractors, or any user authorized by the data exporter to use the Service (who are natural persons) responder Categories of data The Personal Data personal data transferred concern the following categories of data (please specify): Data exporter may submit Personal Data The categories of data are: names, surnames, addresses, account numbers, financial information, PESEL number and other personal data of the subjects mentioned in the documentation sent to the Serviceresponder. Employees, partners, principals, directors, former employees, former partners, former principals, former directors, new hires, individual contractors and temporary staff of the extent data exporter, as well as applicants, dependants, contractors / subcontractors, clients, suppliers/vendors of which is determined and controlled by the data exporter in its sole discretion, and which may include, but is not limited to the following categories of personal data: • First and last name • Business contact information (company, email, phone, physical business address) • Personal contact information (email, cell phone) • Title • Position • Employer • ID data • Professional life data • Personal life data (in the form of security questions and answers) • Connection data • Localization data Special categories of data (if appropriate) The Personal Data transferred concern the following special categories of data (please specify): Data exporter may submit special categories of data to the Service, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include Personal Data concerning health information. Not applicable Processing operations The Personal Data personal data transferred will be subject to the following basic processing activities (please specify): The objective platform Xxxxxxxxxxxx.xxx is internet-based system, that allows the data exporter to send documentation to auditors for the needs of Processing of Personal Data the audit. The documentation will be encrypted by the data importer is while uploading it to the performance platform, so the data importer should not get access to the contents of the Service pursuant documentation and personal data contained in the documentation beyond the scope necessary to perform the Master Subscription Agreementencryption process. DATA EXPORTER Name…….……………………………… Authorised Signature …………………… DATA IMPORTER Name: Xxx Xxxxxx Authorised Signature APPENDIX 2 TO THE STANDARD CONTRACTUAL CLAUSES This Appendix forms part of the Clauses and must be completed and signed by the parties.................................................................................................................................................................

TO THE STANDARD CONTRACTUAL CLAUSES. This Appendix forms part of the Clauses and must be completed and signed by the parties. The Member States may complete or specify, according to their national procedures, any additional necessary information to be contained in this Appendix. Data exporter The data exporter is (please specify briefly your activities relevant to the transfer): Data exporter is the legal entity that has executed the Data Processing Addendum based on the Standard Contractual Clauses as a Data Exporter established within the European Economic area and Switzerland that have purchased the Service on the basis of one or more Order Form(s). Data importer The data importer is (please specify briefly activities relevant to the transfer): Data importer, Okta, Inc., Xxxxxxxxx.xxx is an identity a SaaS provider of Customer Relationship Management and access management cloud service provider which Processes Personal Data, where such data is Customer Data, upon the instruction of the data exporter in accordance with the terms of the Agreement and the Data Processing AddendumMarketing Automation software. Data subjects The personal data transferred concern the following categories of data subjects (please specify): Data exporter may submit Personal Data to the ServiceSubscription Services, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include, but is not limited to Personal Data relating to the following categories of data subjects: • CustomersProspects, customers, business partners, partners and vendors of the data exporter (who are natural persons) • Employees or contact persons of data exporter exporter’s prospects, customers, business partners, partners and vendors • Employees, agents, advisors, contractors, or any user authorized by the freelancers of data exporter to use the Service (who are natural persons) • Data exporter’s Users authorized by data exporter to use the Subscription Services Categories of data The Personal Data personal data transferred concern the following categories of data (please specify): Data exporter may submit Personal Data to the ServiceSubscription Services, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include, but is not limited to the following categories of personal dataPersonal Data: • First and last name • Business contact Title • Position • Employer • Contact information (company, email, phone, physical business address) • Personal contact information (email, cell phone) • Title • Position • Employer • ID data • Professional life data • Personal life data (in the form of security questions and answers) • Connection data • Localization data Special categories of data (if appropriate) The Personal Data personal data transferred concern the following special categories of data (please specify): Data exporter may submit should not transmit special categories of data to the Service, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include Personal Data concerning health informationSubscription Services. Processing operations The Personal Data personal data transferred will be subject to the following basic processing activities (please specify): The objective of Processing of Personal Data by the data importer is the performance of the Service Subscription Services pursuant to the Master Subscription Agreement. DATA EXPORTER Name…….……………………………… Authorised Signature …………………… EXPORTER: Name or Organization: _ Authorized Signature: __ DATA IMPORTER IMPORTER: Name: Xxx Xxxxxx Authorised Signature Systematic Revenue, LLC dba Hatchbuck Authorized Signature: __ APPENDIX 2 TO THE STANDARD CONTRACTUAL CLAUSES This Appendix forms part of the Clauses and must be completed and signed by the parties. Description of the technical and organizational security measures implemented by the data importer in accordance with Clauses 4(d) and 5(c) (or document/legislation attached): Data importer will maintain administrative, physical, and technical safeguards for protection of the security, confidentiality and integrity of Personal Data uploaded to the Subscription Services, as described in the Security, Privacy and Architecture Documentation applicable to the specific Subscription Services purchased by data exporter, and accessible via xxxxx://xxxxxxxxx.xxxxxxxxx.xxx/support/home or otherwise made reasonably available by data importer. Data Importer will not materially decrease the overall security of the Subscription Services during a subscription term.

TO THE STANDARD CONTRACTUAL CLAUSES. This Appendix forms part of the Clauses and must be completed and signed by the parties. The Member States may complete or specify, according to their national procedures, any additional necessary information to be contained in this Appendix. Data exporter [CUSTOMER: PLEASE COMPLETE:] The data exporter is (please specify briefly your activities relevant to the transfer): Data exporter is the legal entity that has executed the Data Processing Addendum based on the Standard Contractual Clauses as a Data Exporter established within the European Economic area and Switzerland that have purchased the Service on the basis of one or more Order Form(s). Data importer The data importer is (please specify briefly activities relevant to the transfer): Data importerXxxxxxxxxXxxxx.xxx, Okta, Inc., Inc. is an identity and access management a provider of enterprise cloud service provider computing solutions which Processes Personal Data, where such processes personal data is Customer Data, upon the instruction of the data exporter in accordance with the terms of the Agreement and the Data Processing AddendumAgreement. Data subjects Subjects The personal data transferred concern the following categories of data subjects (please specify): Data exporter may submit Personal Data to the ServiceServices, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include, but is not limited to Personal Data relating to the following categories of data subjects: • Customers Prospects, customers, business partners, vendors and vendors subcontractors of the data exporter (who are natural persons) •  Employees or contact persons of the data exporter exporter’s customers, business partners, vendors and vendors • subcontractors  Employees, agents, advisors, contractorsfreelancers of the data exporter (who are natural persons), or any user and their family members  The data exporter’s Users authorized by the data exporter to use the Service (who are natural persons) Services Categories of Data The data The Personal Data transferred concern the following categories of data (please specify): Data exporter may submit Personal Data to the ServiceServices, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include, but is not limited to the following categories of personal dataPersonal Data: •  First and last name • Business contact  Title  Position  Employer  Contact information (company, email, phone, physical business address) • Personal contact information (email, cell phone) • Title • Position • Employer •  ID data •  Professional life data •  Professional skills information  Personal life data (in the form of security questions  Health and answers) • medical information  Employee compensation information  Connection data • Localization  Localisation data Special categories of data (if appropriate) The Personal Data personal data transferred concern the following special categories of data (please specify): Data The data exporter may submit special categories of data to the ServiceSCC Services, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include is for the sake of clarity Personal Data with information revealing racial or ethnic origin, trade-union membership, and the processing of data concerning health informationhealth. Processing operations The Personal Data personal data transferred will be subject to the following basic processing activities (please specify): The objective of Processing of Personal Data by the data importer is the performance of the Service SCC Services pursuant to the Master Subscription Agreement. [CUSTOMER: PLEASE SIGN] DATA EXPORTER Name…….: ……………………………………………… . Authorised Signature …………………… …….. DATA IMPORTER Name: Xxx Xxxxxx Xxxx X. Xxxx Authorised Signature APPENDIX 2 TO THE STANDARD CONTRACTUAL CLAUSES This Appendix forms part of the Clauses and must be completed and signed by the parties.……………………

TO THE STANDARD CONTRACTUAL CLAUSES. This Appendix forms part of the Clauses and must be completed and signed by the parties. parties The Member States may complete or specify, according to their national procedures, any additional necessary information to be contained in this Appendix. Data exporter The data exporter is (please specify briefly your activities relevant to the transfer): Data The data exporter is is: (i) the legal entity that has executed the Data Processing Addendum based on the Standard Contractual Clauses as a Data Exporter established within data exporter and, (ii) all Affiliates (as defined in the DPA into which these Standard Contractual Clauses are incorporated) of the data exporter on whose behalf data importer processes personal data of data subjects located in the European Economic area and Area (EEA), Switzerland that have purchased or the Service on the basis of one or more Order Form(s)United Kingdom. Data importer The data importer is (please specify briefly activities relevant to the transfer): Data importerimporter is a provider of automated marketing services which may involve processing personal data provided by, Oktaand pursuant to the instructions and directions of, Inc., is an identity and access management cloud service provider which Processes Personal Data, where such data is Customer Data, upon the instruction of the data exporter in accordance with the terms of the DPA and the Subscription Services Agreement and all related orders between data exporter and data importer (the Data Processing Addendum“Agreement”). Data subjects The personal data transferred concern the following categories of data subjects (please specify): Data exporter may submit Personal Data specify briefly activities relevant to the Service, transfer): The categories of data subjects whose personal data may be processed in connection with the extent of which is services are determined and controlled by the data exporter in its sole discretion, discretion and which may include, include but is are not limited to Personal Data relating to the following categories to: customer, contacts and prospects of data subjects: • Customers, business partners, and vendors of the data exporter (who are natural persons) • Employees exporter; employees or contact persons contractors of data exporter exporter’s customers, business partnerscontacts and prospects, and; employees and vendors • Employees, agents, advisors, contractors, or any user authorized by the contractors of data exporter to use the Service (who are natural persons) exporter. Categories of data The Personal Data personal data transferred concern the following categories of data (please specify): Data exporter may submit Personal Data to the Service, the extent The categories of which is personal data are determined and controlled by the data exporter in its sole discretion, discretion and which may include, include but is are not limited to the following categories of personal datato: • First first and last name • Business name; employer; business role; professional title; contact information (company, e.g. email, phone, physical address); business address) • Personal contact information (emailnetwork; business experience; business interests; localization data, cell phone) • Title • Position • Employer • ID data • Professional life data • Personal life data (in the form of security questions and answers) • Connection data • Localization data and; device identification data. Special categories of data (if appropriate) The Personal Data personal data transferred concern the following special categories of data (please specify): Data exporter may submit special categories of data to the Service, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include Personal Data concerning health information. None Processing operations The Personal Data personal data transferred will be subject to the following basic processing activities (please specify): The objective of Processing of Personal Data by importer will process personal data as necessary to perform the data importer is the performance of the Service services pursuant to the Master Subscription Agreement. The processing operations performed on the personal data will depend on the scope of data exporter’s services and data exporter’s configuration of its FunnelEnvy instance. Such processing operations of personal data as necessary for data importer to provide the services may include the following: collecting. recording, organizing, storage, use, alteration, transmission, retrieval, consultation, archiving and / or destruction. DATA EXPORTER EXPORTER: Name…….……………………………… : Authorised Signature: DATA IMPORTER: Celerius Group, Inc. Name: Xxxx Xxxxxxxxxxxxx Authorised Signature …………………… DATA IMPORTER Name: Xxx Xxxxxx Authorised Signature APPENDIX Appendix 2 TO THE STANDARD CONTRACTUAL CLAUSES to the Standard Contractual Clauses This Appendix forms part of the Clauses and must be completed and signed by the parties.. Description of the technical and organisational security measures implemented by the data importer in accordance with Clauses 4(d) and 5(c) (or document/legislation attached):

TO THE STANDARD CONTRACTUAL CLAUSES. This Appendix forms part of the Clauses and must be completed and signed by the parties. The Member States may complete or specify, according to their national procedures, any additional necessary information to be contained in this Appendix. Data exporter The data exporter is (please specify briefly your activities relevant to the transfer): Data The data exporter is the legal entity that has executed the Data Processing Addendum based on the Standard Contractual Clauses as a Data Exporter established within data exporter, which has purchased Services from data importer pursuant to the European Economic area and Switzerland that have purchased the Service on the basis of one or more Order Form(s)Agreement. Data importer The data importer is (please specify briefly activities relevant to the transfer): Data The data importer is the legal entity that has executed the Standard Contractual Clauses as a data importer, Okta, Inc., is an identity and access management cloud service provider which Processes Personal Data, where such processes personal data is Customer Data, upon the instruction of the data exporter in accordance with the terms of the Agreement and the Data Processing AddendumAgreement. Data subjects The personal data transferred concern the following categories of data subjects (please specify): Data The data exporter may submit Personal Data personal data to the Service, data importer’s Platform to the extent of which is determined and controlled by the data exporter in its sole discretionexporter, and which may include, but is not shall be limited to Personal Data personal data relating to the following categories of data subjects: • Customers, business partners, and vendors of the data exporter (who are natural persons) • Employees or contact persons of data exporter customers, business partners, and vendors • Employees, agents, advisors, contractors, or any user authorized by contractors and customers of the data exporter to use who are Users of the Service Platform (who are natural persons) ). Categories of data The Personal Data personal data transferred concern the following categories of data (please specify): Data The data exporter may submit Personal Data personal data to the Service, data importer’s Platform to the extent of which is determined and controlled by the data exporter in its sole discretionexporter, and which may include, but is not shall be limited to User names, contact information, title, e-mail address, IP address, likeness, location, device ids. The data exporter may submit additional personal data and is responsible for reviewing the following categories legal acceptability of personal all such data: • First and last name • Business contact information (company, email, phone, physical business address) • Personal contact information (email, cell phone) • Title • Position • Employer • ID data • Professional life data • Personal life data (in the form of security questions and answers) • Connection data • Localization data . Special categories of data (if appropriate) The Personal Data personal data transferred concern the following special categories of data (please specify): Data exporter may submit special categories of data to the Service, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include Personal Data concerning health informationNone. Processing operations The Personal Data personal data transferred will be subject to the following basic processing activities (please specify): The objective of Processing of Personal Data personal data by the data importer is the performance of the Service Services pursuant to the Master Subscription Agreement. Agreement in place between the data exporter and the data importer DATA EXPORTER Name…….:……………………………… Authorised Signature …………………… DATA IMPORTER Name: Xxx Xxxxx Xxxxxx Authorised Signature APPENDIX 2 TO THE STANDARD CONTRACTUAL CLAUSES This Appendix forms part of the Clauses and must be completed and signed by the parties.. Description of the technical and organisational security measures implemented by the data importer in accordance with Clauses 4(d) and 5(c) (or document/legislation attached): The data importer will implement reasonable administrative, physical, managerial and technical controls safeguards for protection of the security, confidentiality and integrity of Personal Data uploaded to the Platform in accordance with applicable legal requirements, and as set forth in data importer’s Security Terms and Conditions applicable to the Platform, and as otherwise agreed by the parties in writing. Data importer will not materially decrease the overall security of the Platform during a subscription term. Data Exporter may request a copy of the Data Importers detailed security plans at any time. DATA EXPORTER Name:……………………………… Authorised Signature …………………… DATA IMPORTER Name: Xxxxx Xxxxxx

TO THE STANDARD CONTRACTUAL CLAUSES. This Appendix forms part of the Clauses and must be completed and signed by the parties. The Member States may complete or specify, according to their national procedures, any additional necessary information to be contained in this Appendix. Data exporter The data exporter is (please specify briefly your activities relevant to the transfer): Data exporter is the legal entity that has executed the Data Processing Addendum based on the Standard Contractual these Clauses as a Data Exporter established within data exporter and all Affiliates (as defined in the DPA to which these Clauses are attached) of the data exporter on whose behalf data importer processes personal data of data subjects located in the European Economic area and Area, Switzerland that have purchased or the Service on the basis of one or more Order Form(s)United Kingdom. Data importer The data importer is a provider of cybersecurity products, managed services, and SaaS (please specify briefly activities relevant the “Services”) which may involve processing personal data provided by, and pursuant to the transfer): Data importerinsturctions and directions of, Okta, Inc., is an identity and access management cloud service provider which Processes Personal Data, where such data is Customer Data, upon the instruction of the data exporter in accordance with the terms of athe DPA and services agremment, and all related orders between data exporter and data importer (the Agreement and the Data Processing Addendum“Agreement”). Data subjects The personal data transferred concern the following categories of data subjects (please specify): Data exporter whose personal data may submit Personal Data to be processed in connection with the Service, the extent of which is Services are determined and controlled by the data exporter in its sole discretion, discretion and which may include, include but is are not limited to Personal Data relating to the following categories of data subjectsto: • Customers, business partners, employees and vendors contractors of the data exporter (who are natural persons) • Employees or contact persons exporter, and employees and contractors of the data exporter exporters customers, business suppliers and partners, and vendors • Employees, agents, advisors, contractors, or any user authorized by the data exporter to use the Service (who are natural persons) . Categories of data The Personal Data transferred concern the following categories of personal data may include but are not limited to: • Business contact information, including name, business role, professional title, business contact information (please specify): Data exporter may submit Personal Data to the Serviceaddress, the extent phone number, fax number, email address); • Electronic identification and access credentials for business-managed assets, including IP address, user name, password; • Log data, configuration data and diagnostic output of which is business-managed assets; and • Other categories of personal data determined and controlled by the data exporter in its sole discretion, and which may include, but is not limited to the following categories of personal data: • First and last name • Business contact information (company, email, phone, physical business address) • Personal contact information (email, cell phone) • Title • Position • Employer • ID data • Professional life data • Personal life data (in the form of security questions and answers) • Connection data • Localization data . Special categories of data (if appropriate) The Personal Data transferred concern the following Parties do not intend that special categories of data (please specify): shall be processed under the Agreement. Processing operations Data exporter may submit special categories of importer will process personal data as necessary to perform the Services pursuant to the Service, Agreement and to comply with the extent of Applicable Data Protection Law and other laws to which is determined and controlled by the data exporter and data importer may be subject. Such processing operations may include collecting, recording, organizing, storage, use, alteration, disclosure, transmission, combining, tretireval, consultation, archiving and/or destruction. Processing may be performed in its sole discretionthe European Economic Area, Switzerland, United Kingdom, United States, and which may include Personal Data concerning health information. Processing operations The Personal Data transferred will be subject to the following basic processing activities (please specify): The objective of Processing of Personal Data by the such other countries where data importer is Affiliates or Sub-Processors are located, in accordance with these Clauses and the performance of the Service pursuant to the Master Subscription Agreement. DATA EXPORTER Name…….……………………………… Authorised Signature …………………… Printed Name: TRIPWIRE INTERNAL AND PARTNER CONFIDENTIAL—DO NOT DISTRIBUTE DATA IMPORTER Tripwire, Inc. TRIPWIRE INTERNAL AND PARTNER CONFIDENTIAL—DO NOT DISTRIBUTE Authorised Signature Printed Name: Xxx Xxxxxx Authorised Signature Xxxxxxxx APPENDIX 2 TO THE STANDARD CONTRACTUAL CLAUSES This Appendix forms part of the Clauses and must be completed and signed by the parties.. Data importer will, as a minimum, implement the security measures described in Exhibit 1 to the DPA to which these Clauses are attached. DATA EXPORTER Authorised Signature Printed Name: DATA IMPORTER Tripwire, Inc. TRIPWIRE INTERNAL AND PARTNER CONFIDENTIAL—DO NOT DISTRIBUTE

TO THE STANDARD CONTRACTUAL CLAUSES. This Appendix forms part of the Standard Contractual Clauses and must be completed and signed by the parties. parties The Member States may complete or specify, according to their national procedures, any additional necessary information to be contained in this Appendix. Data exporter The data exporter is (please specify briefly your activities relevant to the transfer): Data exporter Exporter is (i) the legal entity that has executed the Data Processing Addendum based on the Standard Contractual Clauses as a Data Exporter and, (ii) all Authorized Affiliates (as defined in the Pilot DPA) of Customer established within the European Economic area Area (EEA), Switzerland, and Switzerland UK that have purchased Covered Services under the Service on the basis of one or more Order Form(s)Pilot Agreement. Data importer The data importer is (please specify briefly activities relevant to the transfer): Xxxxxxxxxx.xxx, inc. is a provider of enterprise cloud computing solutions which processes Personal Data importer, Okta, Inc., is an identity and access management cloud service provider which Processes Personal Data, where such data is Customer Data, upon the instruction of the data exporter in accordance with the terms of the Pilot Agreement and the Data Processing AddendumPilot DPA. Data subjects The personal data transferred concern the following categories of data subjects (please specify): Data exporter may submit Personal Data to the ServiceCovered Services, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include, but is not limited to Personal Data relating to the following categories of data subjects: • Customers● Prospects, customers, business partners, partners and vendors of the data exporter (who are natural persons) • ● Employees or contact persons of data exporter exporter’s prospects, customers, business partners, partners and vendors • ● Employees, agents, advisors, contractors, or any user authorized by the freelancers of data exporter to use the Service (who are natural persons) ● Data exporter’s Users authorized by data exporter to use the SCC Services Categories of data The Personal Data personal data transferred concern the following categories of data (please specify): Data exporter may submit Personal Data to the ServiceCovered Services, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include, but is not limited to the following categories of personal dataPersonal Data: • ● First and last name • Business contact ● Title ● Position ● Employer ● Contact information (company, email, phone, physical business address) • Personal contact information (email, cell phone) • Title • Position • Employer • ● ID data • ● Professional life data • ● Personal life data (in the form of security questions and answers) • ● Connection data • ● Localization data Special categories of data (if appropriate) The Personal Data personal data transferred concern the following special categories of data (please specify): Data exporter may submit special categories of data to the ServiceCovered Services, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include is for the sake of clarity Personal Data with information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, and the processing of data concerning health informationor sex life. Processing operations The Personal Data personal data transferred will be subject to the following basic processing activities (please specify): The objective of Processing of Personal Data by the data importer is the performance of the Service Covered Services pursuant to the Master Subscription Pilot Agreement. DATA EXPORTER Name…….……………………………… : Authorised Signature …………………… Signature: DATA IMPORTER Name: Xxx Xxxxxx Xxxxx Xxxxxxx Authorised Signature APPENDIX 2 TO THE STANDARD CONTRACTUAL CLAUSES This Appendix forms part of the Clauses and must be completed and signed by the parties.Signature:

TO THE STANDARD CONTRACTUAL CLAUSES. This Appendix forms part of the Clauses and must be completed and signed by the parties. parties The Member States may complete or specify, according to their national procedures, any additional necessary information to be contained in this Appendix. Data exporter The data exporter is (please specify briefly your activities relevant to the transfer): Data exporter Exporter is (i) the legal entity that has executed the Data Processing Addendum based on the Standard Contractual Clauses as a Data Exporter and, (ii) all Affiliates (as defined in the Agreement) of Customer established within the European Economic area Area (EEA) and Switzerland that have purchased the Service SCC Services on the basis of one or more Order Form(s). Data importer The data importer is (please specify briefly activities relevant to the transfer): Data importerXxxxxxxxxx.xxx, Okta, Inc., inc. is an identity and access management a provider of enterprise cloud service provider computing solutions which Processes Personal Data, where such processes personal data is Customer Data, upon the instruction of the data exporter in accordance with the terms of the Agreement and the Data Processing AddendumAgreement. Data subjects The personal data transferred concern the following categories of data subjects (please specify): Data exporter may submit Personal Data to the ServiceSCC Services, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include, but is not limited to Personal Data relating to the following categories of data subjects: • Customers● Prospects, customers, business partners, partners and vendors of the data exporter (who are natural persons) • ● Employees or contact persons of data exporter exporter’s prospects, customers, business partners, partners and vendors • ● Employees, agents, advisors, contractors, or any user authorized by the freelancers of data exporter to use the Service (who are natural persons) ● Data exporter’s Users authorized by data exporter to use the SCC Services Categories of data The Personal Data personal data transferred concern the following categories of data (please specify): Data exporter may submit Personal Data to the ServiceSCC Services, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include, but is not limited to the following categories of personal dataPersonal Data: • ● First and last name • Business contact ● Title ● Position ● Employer ● Contact information (company, email, phone, physical business address) • Personal contact information (email, cell phone) • Title • Position • Employer • ● ID data • ● Professional life data • ● Personal life data (in the form of security questions and answers) • ● Connection data • Localization ● Localisation data Special categories of data (if appropriate) The Personal Data personal data transferred concern the following special categories of data (please specify): Data exporter may submit special categories of data to the ServiceSCC Services, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include is for the sake of clarity Personal Data with information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, and the processing of data concerning health informationor sex life. Processing operations The Personal Data personal data transferred will be subject to the following basic processing activities (please specify): The objective of Processing of Personal Data by the data importer is the performance of the Service SCC Services pursuant to the Master Subscription Agreement. DATA EXPORTER Name…….:………………………………… …….… Authorised Signature …………………… DATA IMPORTER Name: Xxx Xxxxxx Name:………………………………….… Authorised Signature APPENDIX 2 TO THE STANDARD CONTRACTUAL CLAUSES This Appendix forms part of the Clauses and must be completed and signed by the parties.……………………

TO THE STANDARD CONTRACTUAL CLAUSES. This Appendix forms part of the Clauses and must be completed and signed by the parties. parties The Member States may complete or specify, according to their national procedures, any additional necessary information to be contained in this Appendix. Data exporter The data exporter is (please specify briefly your activities relevant to the transfer): Data exporter Exporter is (i) the legal entity that has executed the Data Processing Addendum based on the Standard Contractual Clauses as a Data Exporter and, (ii) all Affiliates (as defined in the Agreement) of Customer established within the European Economic area Area (EEA) and Switzerland that have purchased the Service SCC Services on the basis of one or more Order Form(s). Data importer The data importer is (please specify briefly activities relevant to the transfer): Data importerSafePaaS, Okta, Inc., Inc. is an identity and access management a provider of enterprise cloud service provider computing solutions which Processes Personal Data, where such processes personal data is Customer Data, upon the instruction of the data exporter in accordance with the terms of the Agreement and the Data Processing AddendumAgreement. Data subjects The personal data transferred concern the following categories of data subjects (please specify): Data exporter may submit Personal Data to the ServiceSCC Services, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include, but is not limited to Personal Data relating to the following categories of data subjects: • Customers● Prospects, customers, business partners, partners and vendors of the data exporter (who are natural persons) • ● Employees or contact persons of data exporter exporter’s prospects, customers, business partners, partners and vendors • ● Employees, agents, advisors, contractors, or any user authorized by the freelancers of data exporter to use the Service (who are natural persons) ● Data exporter’s Users authorized by data exporter to use the SCC Services Categories of data The Personal Data personal data transferred concern the following categories of data (please specify): Data exporter may submit Personal Data to the ServiceSCC Services, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include, but is not limited to the following categories of personal dataPersonal Data: • ● First and last name • Business contact ● Title ● Position ● Employer ● Contact information (company, email, phone, physical business address) • Personal contact information (email, cell phone) • Title • Position • Employer • ● ID data • ● Professional life data • ● Personal life data (in the form of security questions and answers) • ● Connection data • ● Localization data Special categories of data (if appropriate) The Personal Data personal data transferred concern the following special categories of data (please specify): Data exporter may submit special categories of data to the ServiceSCC Services, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include is for the sake of clarity Personal Data with information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade-union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health informationor data concerning a natural person’s sex life or sexual orientation. Processing operations The Personal Data personal data transferred will be subject to the following basic processing activities (please specify): The objective of Processing of Personal Data by the data importer is the performance of the Service SCC Services pursuant to the Master Subscription Agreement. DATA EXPORTER Name…….:………………………………… …….… Authorised Signature …………………… DATA IMPORTER Name: Xxx Xxxxxx :………………………………….… Authorised Signature APPENDIX 2 TO THE STANDARD CONTRACTUAL CLAUSES This Appendix forms part of the Clauses and must be completed and signed by the parties.……………………

TO THE STANDARD CONTRACTUAL CLAUSES. This Appendix forms part of the Clauses and must be completed and signed by the parties. parties The Member States may complete or specify, according to their national procedures, any additional necessary information to be contained in this Appendix. Data exporter The data exporter is (please specify briefly your activities relevant to the transfer): Data exporter Exporter is (i) the legal entity that has executed the Data Processing Addendum based on the Standard Contractual Clauses as a Data Exporter and, (ii) all Affiliates (as defined in the Agreement) of Customer established within the European Economic area Area (EEA) and Switzerland the United Kingdom that have purchased the Service Services on the basis of one or more Service Order Form(s). ) Data importer The data importer is (please specify briefly activities relevant to the transfer): Data importer, Okta, Inc., MapAnything is an identity and access management a provider of enterprise cloud service provider computing solutions which Processes Personal Data, where such processes personal data is Customer Data, upon the instruction of the data exporter in accordance with the terms of the Agreement Agreement. Processing on data exporter’s behalf will include data storage and user usage analytics in the Data Processing Addendumnew platform. Data subjects The personal data transferred concern the following categories of data subjects (please specify): Data exporter may submit Personal Data to the ServiceServices, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include, but is not limited to Personal Data relating to the following categories of data subjects: • Customers● Prospects, customers, business partners, partners and vendors of the data exporter Customer (who are natural persons) • ● Employees or contact persons of data exporter Customer’s prospects, customers, business partners, partners and vendors • ● Employees, agents, advisors, contractors, or any user authorized by the data exporter to use the Service freelancers of Customer (who are natural persons) ● Customer’s Authorized Users authorized by Customer to use the Services Categories of data The Personal Data personal data transferred concern the following categories of data (please specify): Data exporter may submit Personal Data to the ServiceServices, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include, but is not limited to the following categories of personal dataPersonal Data: • ● First and last name • Business contact ● Title ● Position ● Employer ● Contact information (company, email, phone, physical business address) • Personal contact ● Account information (email, cell phone) • Title • Position • Employer • ID data • Professional life data • ● Device information ● Personal life data (in the form of security questions ● Professional life date ● Usage and answers) • Connection preference information ● Geolocation data • Localization data ● Driver and vehicle information Special categories of data (if appropriate) The Personal Data personal data transferred concern the following special categories of data (please specify): Data exporter may submit special categories of data to the ServiceServices, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include is for the sake of clarity Personal Data with information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, and the processing of data concerning health informationor sex life. Processing operations The Personal Data personal data transferred will be subject to the following basic processing activities (please specify): The objective of Processing of Personal Data by the data importer is the performance of the Service Services pursuant to the Master Subscription Agreement. DATA EXPORTER Name…….:………………………………… …….… Authorised Signature …………………… DATA IMPORTER IRMicPhOaRrTdERJ. Xxxxxx Name: Xxx Xxxxxx :………………………………….… Authorised Signature APPENDIX 2 TO THE STANDARD CONTRACTUAL CLAUSES This Appendix forms part of the Clauses and must be completed and signed by the parties.……………………

TO THE STANDARD CONTRACTUAL CLAUSES. This Appendix forms part of the Clauses and must be completed and signed by the parties. The Member States may complete or specify, according to their national procedures, any additional necessary information to be contained in this Appendix. Data exporter The data exporter is (please specify briefly your activities relevant to the transfer): Data exporter is the legal entity that has executed the Data Processing Addendum based on the Standard Contractual Clauses as a Data Exporter established within the European Economic area and Switzerland that have purchased the Service on the basis of one or more Order Form(s). is: Data importer The data importer is is: Go-Cort, Inc. (please specify briefly activities relevant to the transfer): Data importer, Okta, Inc., is an identity and access management cloud service provider which Processes Personal Data, where such data is Customer Data, upon the instruction of the data exporter in accordance with the terms of the Agreement and the Data Processing Addendum. DBA Apptoto) Data subjects The personal data transferred concern the following categories of data subjects (please specify): Data exporter may submit Personal Data to the Service, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include, but is not limited to Personal Data relating to the following categories of data subjects: • Customers● Prospective clients, clients, business partners, and vendors of the data exporter Customer (who are natural persons) • Employees or ); ● Employees, agents, family members, and contact persons of data exporter customersCustomer’s prospective clients, clients, business partners, and vendors • vendors; ● Employees, agents, advisors, contractors, or any user authorized by the data exporter to use the Service and freelancers of Customer (who are natural persons) ); or ● Users authorized by Customer to use Apptoto Services. Categories of data The Personal Data personal data transferred concern the following categories of data (please specify): Data exporter may submit Personal Data to the Service, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include, but is not limited to the following categories of personal data: • First ● First, middle, and last name • Business and nicknames; ● Title; ● Email address; ● Phone number; ● Other contact information; ● Appointment information (companyevent title, emaillocation, phonenotes, physical business time); ● IP address) • Personal contact information (email, cell phone) • Title • Position • Employer • ID data • Professional life data • ; or ● Personal life data (in the form of security questions and answers) • Connection data • Localization data including additional notes added by user). Special categories of data (if appropriate) The Personal Data personal data transferred concern the following special categories of data (please specify): Data exporter may submit special categories of data to the Service, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include Personal Data concerning health informationdata: ● Health data. Processing operations The Personal Data personal data transferred will be subject to the following basic processing activities (please specify): The objective of activities: ● Processing of Personal Appointment Data by the data importer is the performance in order to send automated messages before, during, and after appointments. ● Also processing of the Service pursuant Appointment Data to the Master Subscription Agreementfacilitate scheduling of new appointments. DATA EXPORTER Name…….……………………………… Authorised : Authorized Signature …………………… DATA IMPORTER Name: Xxx Xxxxxx Authorised Authorized Signature APPENDIX 2 TO THE STANDARD CONTRACTUAL CLAUSES This Appendix forms part of the Clauses and must be completed and signed by the parties.. Description of the technical and organizational security measures implemented by the data importer in accordance with Clauses 4(d) and 5(c):

TO THE STANDARD CONTRACTUAL CLAUSES. This Appendix forms part of the Clauses and must be completed and signed by the parties. The Member States may complete or specify, according to their national procedures, any additional necessary information to be contained in this Appendix. Data exporter The data exporter is (please specify briefly your activities relevant to the transfer): Data The data exporter is is: (i) the legal entity that has executed the Data Processing Addendum based on the Standard Contractual Clauses as a Data Exporter established within data exporter and, (ii) all Affiliates of the data exporter on whose behalf data importer processes personal data of data subjects located in the European Economic area and Area (EEA), Switzerland that have purchased or the Service on the basis of one or more Order Form(s)United Kingdom. Data importer The data importer is (please specify briefly activities relevant to the transfer): Data importerimporter is a provider of digital publications software (the “Services") which involves processing personal data provided by, Oktaand pursuant to the instructions and directions of, Inc., is an identity and access management cloud service provider which Processes Personal Data, where such data is Customer Data, upon the instruction of the data exporter in accordance with the terms of the Agreement DPA and all related orders between data exporter and data importer (the Data Processing Addendum"Agreement’). Data subjects The personal data transferred concern the following categories of data subjects (please specify): Data exporter : The categories of data subjects whose personal data may submit Personal Data to be processed in connection with the Service, the extent of which is Subscription Services are determined and controlled by the data exporter in its sole discretion, discretion and which may include, include but is are not limited to Personal Data relating to the following categories to: customers, contacts and prospects of data subjects: • Customers, business partners, and vendors of the data exporter (who are natural persons) • Employees exporter; employees or contact persons contractors of data exporter customers, business partners, and vendors • Employees, agents, advisors, contractors, or any user authorized by the data exporter to use the Service (who are natural persons) exporter. Categories of data The Personal Data personal data transferred concern the following categories of data (please specify): Data exporter may submit Personal Data to the Service, the extent : The categories of which is personal data are determined and controlled by the data exporter in its sole discretion, discretion and which may include, include but is are not limited to the following categories of personal datato: • First first and last name • Business name; employer; business role; professional title; contact information (companye,g., email, phone, physical address); business address) • Personal contact information (emailnetwork; business experience; business interests; localiazation data, cell phone) • Title • Position • Employer • ID data • Professional life data • Personal life data (in the form of security questions and answers) • Connection data • Localization data and; device identification data. Special categories of data (if appropriate) The Personal Data personal data transferred concern the following special categories of data (please specify): Data exporter may submit special : Special categories of data to the Servicepersonal data, the extent of which is if any, are determined and controlled by the data exporter in its sole discretiondiscretion and may include, and which may include Personal Data concerning but are not limited to, information revealing racial/ethnic origin, political, religious or philosophical beliefs, trade union membership or health informationdata. Processing operations The Personal Data personal data transferred will be subject to the following basic processing activities (please specify): The objective of Processing of Personal : Data by importer will process personal data as necessary to perform the data importer is the performance of the Service Services pursuant to the Master Subscription Agreement. DATA EXPORTER Name…….:……………………………… Authorised Signature …………………… DATA IMPORTER Name: Xxx Xxxxxx Xxxx Authorised Signature APPENDIX 2 TO THE STANDARD CONTRACTUAL CLAUSES This Appendix forms part of the Clauses and must be completed and signed by the parties.Signature:

TO THE STANDARD CONTRACTUAL CLAUSES. This Appendix forms part of the Clauses and must be completed and signed by the parties. The Member States may complete or specify, according to their national procedures, any additional necessary information to be contained in this Appendix. Data exporter The data exporter is (please specify briefly your activities relevant to the transfer): Data exporter Exporter is (i) the legal entity that has executed the Data Processing Addendum based on the Standard Contractual Clauses as a Data Exporter and, (ii) all Affiliates (as defined in the Agreement) of Customer established within the European Economic area Area (EEA) and Switzerland that have purchased the Service SCC Services on the basis of one or more Order Form(s). Data importer The data importer is (please specify briefly activities relevant to the transfer): Data importer, Okta, Inc., essensys Limited is an identity and access management a provider of enterprise cloud service provider computing solutions which Processes Personal Data, where such processes personal data is Customer Data, upon the instruction of the data exporter in accordance with the terms of the Agreement and the Data Processing AddendumAgreement. Data subjects The personal data transferred concern the following categories of data subjects (please specify): Data exporter may submit Personal Data to the ServiceSCC Services, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include, but is not limited to Personal Data relating to the following categories of data subjects: • Customers● Prospects, customers, business partners, partners and vendors of the data exporter (who are natural persons) • ● Employees or contact persons of data exporter exporter’s prospects, customers, business partners, partners and vendors • ● Employees, agents, advisors, contractors, or any user authorized by the freelancers of data exporter to use the Service (who are natural persons) ● Data exporter’s Users authorized by data exporter to use the SCC Services Categories of data The Personal Data personal data transferred concern the following categories of data (please specify): Data exporter may submit Personal Data to the ServiceSCC Services, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include, but is not limited to the following categories of personal dataPersonal Data: • ● First and last name • Business contact ● Title ● Position ● Employer ● Contact information (company, email, phone, physical business address) • Personal contact information (email, cell phone) • Title • Position • Employer • ● ID data • ● Professional life data • Personal life data (in the form of security questions and answers) • ● Connection data • Localization ● Localisation data Special categories of data (if appropriate) The Personal Data personal data transferred concern the following special categories of data (please specify): Data exporter may submit special categories of data to the ServiceSCC Services, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include is for the sake of clarity Personal Data with information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, and the processing of data concerning health informationor sex life. Processing operations The Personal Data personal data transferred will be subject to the following basic processing activities (please specify): The objective of Processing of Personal Data by the data importer is the performance of the Service SCC Services pursuant to the Master Subscription Agreement. DATA EXPORTER Name…….……………………………… : Authorised Signature …………………… Signature: DATA IMPORTER Name: Xxx Xxxxxx Xxxxx Xxxxx Authorised Signature Signature: APPENDIX 2 TO THE STANDARD CONTRACTUAL CLAUSES This Appendix forms part of the Clauses and must be completed and signed by the parties.parties Description of the technical and organisational security measures implemented by the data importer in accordance with Clauses 4(d) and 5(c) (or document/legislation attached): Data importer will maintain administrative, physical, and technical safeguards for protection of the security, confidentiality and integrity of Personal Data uploaded to the SCC Services, as described in the Security, Privacy and Architecture Documentation applicable to the specific SCC Services purchased by data exporter, and accessible via xxxx://xxxx.xxxxxxxx.xxxx or otherwise made reasonably available by data importer. Data Importer will not materially decrease the overall security of the SCC Services during a subscription term. DATA EXPORTER Name: Authorised Signature: DATA IMPORTER Name: Xxxxx Xxxxx

TO THE STANDARD CONTRACTUAL CLAUSES. This Appendix forms part of the Clauses and must be completed and signed by the partiesClauses. The Member States may complete or specify, according to their national procedures, any additional necessary information to be contained in this Appendix. Data exporter DATA EXPORTER. The data exporter is (please specify briefly your activities relevant to the transfer): Data exporter is i) the legal entity that has executed the Data Processing Addendum based on the Standard Contractual Clauses as a Data Exporter Agreement with Frevvo and (ii) all affiliates of such entity established within the European Economic area and Switzerland that EEA, which have purchased services from Frevvo or its Affiliates. The data exporter has appointed the data importer to provide the Service on as specified in the basis Agreement. To facilitate the provision of one or more Order Form(s)the Service, the data exporter may provide to the data importer access to the Personal Data described below. Data importer DATA IMPORTER. The data importer is (please specify briefly activities relevant to Frevvo which provides the transfer): Service. The data importer will be the recipient of Personal Data importer, Okta, Inc., which is an identity and access management cloud service provider which Processes Personal Data, where such data is Customer Data, upon the instruction of exported by the data exporter in accordance with to the terms of the Agreement and the data importer as described below. DATA SUBJECTS. The Personal Data Processing Addendum. Data subjects The personal data transferred may concern the following categories of data subjects (please specify): Data subjects: The data exporter may submit Personal Data to the ServiceFrevvo and its Affiliates, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include, but is not limited to Personal Data relating to the following categories of data subjects: • CustomersProspective customers, customers, resellers, referrers, business partners, and vendors of the data exporter (who are natural persons) ); • Employees or contact persons of the data exporter exporter’s prospective customers, customers, resellers, referrers, subcontractors, business partners, and vendors (who are natural persons); • Employees, agents, advisors, contractors, or any user and freelancers of the data exporter (who are natural persons); and/or • Natural persons authorized by the data exporter to use the Service (who are natural persons) Categories of services provided by Frevvo to the data exporter. CATEGORIES OF DATA. The data subjects’ Personal Data transferred may concern the following categories of data (please specify): Data The data exporter may submit Personal Data to the ServiceFrevvo and its Affiliates, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include, but is not limited to to, the following categories of personal dataPersonal Data: • First and last name • Business contact information (companyNames, emailtitles, phoneposition, physical business address) • Personal employer, contact information (email, cell phone) • Title • Position • Employer • ID data • Professional , fax, physical address etc.), identification data, professional life data • Personal data, personal life data, connection data, or localization data (in the form of security questions and answers) • Connection including IP addresses). SPECIAL CATEGORIES OF DATA (IF APPROPRIATE). The data • Localization data Special categories of data (if appropriate) The Personal Data transferred concern the following special categories of data (please specify): Data exporter may submit special categories of data to the ServiceFrevvo and its Affiliates, the extent of which is determined and controlled by the data exporter in its sole discretion. Such special categories of data include, but may not be limited to, Personal Data with information revealing racial or ethnic origins, political opinions, religious or philosophical beliefs, trade-union membership, and which may include Personal Data the processing of data concerning an individual’s health information. Processing operations The Personal Data transferred will be subject to the following basic processing activities (please specify): The objective of Processing of Personal Data by the data importer is the performance of the Service pursuant to the Master Subscription Agreement. DATA EXPORTER Name……or sexual and gender orientation.……………………………… Authorised Signature …………………… DATA IMPORTER Name: Xxx Xxxxxx Authorised Signature APPENDIX 2 TO THE STANDARD CONTRACTUAL CLAUSES This Appendix forms part of the Clauses and must be completed and signed by the parties.

TO THE STANDARD CONTRACTUAL CLAUSES. This Appendix forms part of the Clauses and must be completed and signed by the parties. The Member States may complete or specify, according to their national procedures, any additional necessary information to be contained in this Appendix. Data exporter The data exporter is (please specify briefly your activities relevant to the transfer): Data exporter is the legal entity that has executed the Data Processing Addendum based on the Standard Contractual Clauses as a Data Exporter established within the European Economic area and Switzerland that have purchased the Service on the basis of one or more Order Form(s). Data importer The data importer is (please specify briefly activities relevant to the transfer): Data importer, Okta, Inc., Xxxxxxxxx.xxx is an identity a SaaS provider of Customer Relationship Management and access management cloud service provider which Processes Personal Data, where such data is Customer Data, upon the instruction of the data exporter in accordance with the terms of the Agreement and the Data Processing AddendumMarketing Automation software. Data subjects The personal data transferred concern the following categories of data subjects (please specify): Data exporter may submit Personal Data to the ServiceSubscription Services, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include, but is not limited to Personal Data relating to the following categories of data subjects: • Customers Prospects, customers, business partners, partners and vendors of the data exporter (who are natural persons) •  Employees or contact persons of data exporter exporter’s prospects, customers, business partners, partners and vendors •  Employees, agents, advisors, contractors, or any user authorized by the freelancers of data exporter to use the Service (who are natural persons)  Data exporter’s Users authorized by data exporter to use the Subscription Services Categories of data The Personal Data personal data transferred concern the following categories of data (please specify): Data exporter may submit Personal Data to the ServiceSubscription Services, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include, but is not limited to the following categories of personal dataPersonal Data: •  First and last name • Business contact  Title  Position  Employer  Contact information (company, email, phone, physical business address) • Personal contact information (email, cell phone) • Title • Position • Employer •  ID data •  Professional life data •  Personal life data (in the form of security questions and answers) • Connection data • Localization data Special categories of data (if appropriate) The Personal Data personal data transferred concern the following special categories of data (please specify): Data exporter may submit should not transmit special categories of data to the Service, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include Personal Data concerning health informationSubscription Services. Processing operations The Personal Data personal data transferred will be subject to the following basic processing activities (please specify): The objective of Processing of Personal Data by the data importer is the performance of the Service Subscription Services pursuant to the Master Subscription Agreement. DATA EXPORTER Name…….……………………………… Authorised Signature …………………… EXPORTER: Name or Organization: _ Authorized Signature: __ DATA IMPORTER IMPORTER: Name: Xxx Xxxxxx Authorised Signature Systematic Revenue, LLC dba Hatchbuck Authorized Signature: __ APPENDIX 2 TO THE STANDARD CONTRACTUAL CLAUSES This Appendix forms part of the Clauses and must be completed and signed by the parties. Description of the technical and organizational security measures implemented by the data importer in accordance with Clauses 4(d) and 5(c) (or document/legislation attached): Data importer will maintain administrative, physical, and technical safeguards for protection of the security, confidentiality and integrity of Personal Data uploaded to the Subscription Services, as described in the Security, Privacy and Architecture Documentation applicable to the specific Subscription Services purchased by data exporter, and accessible via xxxxx://xxxxxxxxx.xxxxxxxxx.xxx/support/home or otherwise made reasonably available by data importer. Data Importer will not materially decrease the overall security of the Subscription Services during a subscription term.

TO THE STANDARD CONTRACTUAL CLAUSES. This Appendix forms part of the Clauses and must be completed and signed by the parties. The Member States may complete or specify, according to their national procedures, any additional necessary information to be contained in this Appendix. Data exporter [CUSTOMER: PLEASE COMPLETE:] The data exporter is (please specify briefly your activities relevant to the transfer): Data exporter is the legal entity that has executed the Data Processing Addendum based on the Standard Contractual Clauses as a Data Exporter established within the European Economic area and Switzerland that have purchased the Service on the basis of one or more Order Form(s). Data importer The data importer is (please specify briefly activities relevant to the transfer): Data importerXxxxxxxxxXxxxx.xxx, Okta, Inc., inc. is an identity and access management a provider of enterprise cloud service provider computing solutions which Processes Personal Data, where such processes personal data is Customer Data, upon the instruction of the data exporter in accordance with the terms of the Agreement and the Data Processing AddendumAgreement. Data subjects Subjects The personal data transferred concern the following categories of data subjects (please specify): Data exporter may submit Personal Data to the ServiceServices, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include, but is not limited to Personal Data relating to the following categories of data subjects: • CustomersProspects, customers, business partners, vendors and vendors subcontractors of the data exporter (who are natural persons) • Employees or contact persons of the data exporter exporter’s customers, business partners, vendors and vendors subcontractors • Employees, agents, advisors, contractorsfreelancers of the data exporter (who are natural persons), or any user and their family members • The data exporter’s Users authorized by the data exporter to use the Service (who are natural persons) Services Categories of Data The data The Personal Data transferred concern the following categories of data (please specify): Data exporter may submit Personal Data to the ServiceServices, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include, but is not limited to the following categories of personal dataPersonal Data: • First and last name • Business contact Title • Position • Employer • Contact information (company, email, phone, physical business address) • Personal contact information (email, cell phone) • Title • Position • Employer • ID data • Professional life data • Professional skills information • Personal life data (in the form of security questions • Health and answers) medical information • Employee compensation information • Connection data • Localization Localisation data Special categories of data (if appropriate) The Personal Data personal data transferred concern the following special categories of data (please specify): Data The data exporter may submit special categories of data to the ServiceSCC Services, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include is for the sake of clarity Personal Data with information revealing racial or ethnic origin, trade-union membership, and the processing of data concerning health informationhealth. Processing operations The Personal Data personal data transferred will be subject to the following basic processing activities (please specify): The objective of Processing of Personal Data by the data importer is the performance of the Service SCC Services pursuant to the Master Subscription Agreement. [CUSTOMER: PLEASE SIGN] DATA EXPORTER Name…….: ……………………………………………… . Authorised Signature …………………… …….. DATA IMPORTER Name: Xxx Xxxxxx Xxxx X. Xxxx Authorised Signature APPENDIX 2 TO THE STANDARD CONTRACTUAL CLAUSES This Appendix forms part of the Clauses and must be completed and signed by the parties.……………………

TO THE STANDARD CONTRACTUAL CLAUSES. This Appendix forms part of the Clauses and must be completed and signed by the parties. parties The Member States may complete or specify, according to their national procedures, any additional necessary information to be contained in this Appendix. Data exporter The data exporter is (please specify briefly your activities relevant to the transfer): Data exporter Exporter is (i) the legal entity that has executed the Data Processing Addendum based on the Standard Contractual Clauses as a Data Exporter and, (ii) all Affiliates (as defined in the Agreement) of Customer established within the European Economic area and Switzerland Area (EEA) that have purchased the Service SCC Services on the basis of one or more Order Form(sService Order(s). The Data Exporter is responsible for the following: ● Designing personal data processing jobs ● Scheduling execution data processing activities ● Security of the data exporter managed cloud infrastructure provider ● Security of the data exporter managed data and data stores ● Relationship, Agreement with the cloud infrastructure provider ● Service user access provisioning Data importer The data importer is (please specify briefly activities relevant to the transfer): Data importerQubole, OktaInc. is a provider of enterprise cloud computing solutions which provides big data orchestration services to help the data exporter design, Inc., is an identity execute and access management cloud service provider which Processes Personal Data, where such schedule data is Customer Data, upon the instruction of processing jobs that may involved personal data controlled by the data exporter in accordance with the terms of the Agreement and Agreement. Qubole will execute data processing jobs as instructed by the Data Processing Addendumdata exporter. Data subjects The personal data transferred concern the following categories of data subjects (please specify): Data For data export access to the Qubole service, the data exporter at a minimum provide employee details of its Qubole user population. In addition to the data subject categories required to access the Qubole Service, data exporter may submit Personal Data to the ServiceSCC Services, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include, but is not limited to Personal Data relating to the following categories of data subjects: • Customers, business partners, and vendors of the data exporter subjects (who are natural persons) • Employees or contact persons of data exporter customers, business partners, and vendors • Employees, agents, advisors, contractors, or any user authorized by the data exporter Data Exporter to use the Service (who are natural persons) Complete): ● Categories of data The Personal Data personal data transferred concern the following categories of data (please specify): Data For data exporter access to the Qubole service, the data exporter at a minimum provide the following personal data elements: ● Employee Name (first and last) ● Employee email ● Employee password for the Qubole service or other service authentication credential In addition to the personal data elements required to access the Service, the data exporter may submit Personal Data to the ServiceSCC Services, to the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include, but is not limited to the following categories of personal data: • First and last name • Business contact information Personal Data (company, email, phone, physical business address) • Personal contact information (email, cell phone) • Title • Position • Employer • ID data • Professional life data • Personal life data (in the form of security questions and answers) • Connection data • Localization data Data Exporter to Compete): ● Special categories of data (if appropriate) The Personal Data personal data transferred concern the following special categories of data (please specify): Data exporter may submit special categories of data to the ServiceSCC Services, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include is for the sake of clarity Personal Data with information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, and the processing of data concerning health informationor sex life. Processing operations The Personal Data personal data transferred will be subject to the following basic processing activities (please specify): The objective of Processing of Personal Data by the data importer is the performance of the Service SCC Services pursuant to the Master Subscription Agreement. DATA EXPORTER DATA IMPORTER Name…….:………………………………… Authorised …….… Name: Xxxx Xxxxxxx Authorized Signature …………………… DATA IMPORTER NameAuthorized Signature: Xxx Xxxxxx Authorised Signature APPENDIX 2 TO THE STANDARD CONTRACTUAL CLAUSES This Appendix forms part of the Clauses and must be completed and signed by the partiesparties Description of the technical and organizational security measures implemented by the data importer in accordance with Clauses 4(d) and 5(c) (or document/legislation attached): Data importer will maintain administrative, physical, and technical safeguards for protection of the security, confidentiality and integrity of Personal Data uploaded to the SCC Services, as described in the Security and Privacy Documentation applicable to the specific SCC Services purchased by data exporter, and accessible via xxxx://xxxx.xxxxxx.xxx or otherwise made reasonably available by data importer. Data Importer will not materially decrease the overall security of the SCC Services during a subscription term. DATA EXPORTER DATA IMPORTER Name:………………………………….… Name: Xxxx Xxxxxxx

TO THE STANDARD CONTRACTUAL CLAUSES. This Appendix forms part of the Clauses and must be completed and signed by the parties. parties The Member States may complete or specify, according to their national procedures, any additional necessary information to be contained in this Appendix. Data exporter The data exporter is (please specify briefly your activities relevant to the transfer): Data exporter Exporter is (i) the legal entity that has executed the Data Processing Addendum based on the Standard Contractual Clauses as a Data Exporter and, (ii) all Affiliates (as defined in the Agreement) of Customer established within the European Economic area and Switzerland Area (EEA) that have purchased the Service SCC Services on the basis of one or more Order Form(sService Order(s). The Data Exporter is responsible for the following: ● Designing personal data processing jobs ● Scheduling execution data processing activities ● Security of the data exporter managed cloud infrastructure provider ● Security of the data exporter managed data and data stores ● Relationship, Agreement with the cloud infrastructure provider ● Service user access provisioning Data importer The data importer is (please specify briefly activities relevant to the transfer): Data importerQubole, OktaInc. is a provider of enterprise cloud computing solutions which provides big data orchestration services to help the data exporter design, Inc., is an identity execute and access management cloud service provider which Processes Personal Data, where such schedule data is Customer Data, upon the instruction of processing jobs that may involved personal data controlled by the data exporter in accordance with the terms of the Agreement and Agreement. Qubole will execute data processing jobs as instructed by the Data Processing Addendumdata exporter. Data subjects The personal data transferred concern the following categories of data subjects (please specify): Data For data export access to the Qubole service, the data exporter at a minimum provide employee details of its Qubole user population. In addition to the data subject categories required to access the Qubole Service, data exporter may submit Personal Data to the ServiceSCC Services, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include, but is not limited to Personal Data relating to the following categories of data subjects: • Customers, business partners, and vendors of the data exporter subjects (who are natural persons) • Employees or contact persons of data exporter customers, business partners, and vendors • Employees, agents, advisors, contractors, or any user authorized by the data exporter Data Exporter to use the Service (who are natural persons) Complete): ● Categories of data The Personal Data personal data transferred concern the following categories of data (please specify): Data For data exporter access to the Qubole service, the data exporter at a minimum provide the following personal data elements: ● Employee Name (first and last) ● Employee email ● Employee password for the Qubole service or other service authentication credential In addition to the personal data elements required to access the Service, the data exporter may submit Personal Data to the ServiceSCC Services, to the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include, but is not limited to the following categories of personal data: • First and last name • Business contact information Personal Data (company, email, phone, physical business address) • Personal contact information (email, cell phone) • Title • Position • Employer • ID data • Professional life data • Personal life data (in the form of security questions and answers) • Connection data • Localization data Data Exporter to Compete): ● Special categories of data (if appropriate) The Personal Data personal data transferred concern the following special categories of data (please specify): Data exporter may submit special categories of data to the ServiceSCC Services, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include is for the sake of clarity Personal Data with information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, and the processing of data concerning health informationor sex life. Processing operations The Personal Data personal data transferred will be subject to the following basic processing activities (please specify): The objective of Processing of Personal Data by the data importer is the performance of the Service SCC Services pursuant to the Master Subscription Agreement. DATA EXPORTER DATA IMPORTER Name…….:………………………………… Authorised …….… Name: Authorized Signature …………………… DATA IMPORTER NameAuthorized Signature: Xxx Xxxxxx Authorised Signature Xxxx Xxxxxxx APPENDIX 2 TO THE STANDARD CONTRACTUAL CLAUSES This Appendix forms part of the Clauses and must be completed and signed by the partiesparties Description of the technical and organizational security measures implemented by the data importer in accordance with Clauses 4(d) and 5(c) (or document/legislation attached): Data importer will maintain administrative, physical, and technical safeguards for protection of the security, confidentiality and integrity of Personal Data uploaded to the SCC Services, as described in the Security and Privacy Documentation applicable to the specific SCC Services purchased by data exporter, and accessible via xxxx://xxxx.xxxxxx.xxx or otherwise made reasonably available by data importer. Data Importer will not materially decrease the overall security of the SCC Services during a subscription term. DATA EXPORTER DATA IMPORTER Name:………………………………….… Name: Authorized Signature …………………… Authorized Signature:

TO THE STANDARD CONTRACTUAL CLAUSES. This Appendix forms part of the Clauses and must be completed and signed by the parties. The Member States may complete or specify, according to their national procedures, any additional necessary information to be contained in this Appendix. Data exporter Exporter The data exporter is (please specify briefly your activities relevant to the transfer): Data exporter is the legal entity that has executed the Data Processing Addendum based on the Standard Contractual Clauses as a Data Exporter established within the European Economic area and Switzerland that have purchased the Service on the basis of one or more Order Form(s)Exporters are engaged in [ ]. Data importer The data importer Importer LTSE is (please specify briefly activities relevant to the transfer): Data importera provider of company management software and services, Okta, Inc., is an identity and access management cloud service provider which Processes Personal Data, where such data is Customer Data, upon the instruction of the data exporter in accordance assisting with the terms financial, operational and legal aspects of the Agreement and the Data Processing Addendummanaging a company. Data subjects The personal data transferred concern the following categories of data subjects (please specify): Data exporter may submit Personal Data to the Service, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include, but is not limited to Personal Data relating to the following categories of data subjects: • Customers, business partners, and vendors of the data exporter (who are natural persons) • Employees or contact persons of data exporter customers, business partners, and vendors • Employees, agents, advisors, contractors, or any user authorized by the data exporter to use the Service (who are natural persons) Categories of data The Personal Data transferred concern the following categories of data (please specify): Data exporter may submit Personal Data to the Service, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include, but is not limited to the following categories of personal data: • First and last name • Business contact information (company, email, phone, physical business address) • Personal contact information (email, cell phone) • Title • Position • Employer • ID data • Professional life data • Personal life data (in the form of security questions and answers) • Connection data • Localization data Special categories of data (if appropriate) The Personal Data transferred concern the following special categories of data (please specify): Data exporter may submit special categories of data to the ServiceLTSE, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include Personal Data concerning health information. Processing operations The Personal Data transferred will be subject relating to the following basic processing activities categories of data subjects: • Shareholders of data exporter • Employees, agents, advisors, freelancers or contact persons of data exporter • Data Exporter’s users authorized by data exporter to use LTSE software and services The precise description of the affected data subjects can be found under LTSE’s services description site xxxxx://xxxx.xxx/tools/gdpr-services. Categories of data The personal data transferred concern the following categories of data Data exporter may submit Personal Data to LTSE, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include the following categories of Personal Data: • Contact information (please specify): name, email, phone, address) • Professional life data (company, title, position, employer, compensation, company legal and financial information) • Personal life data (gender) • Localization data • Legal documents, such as company formation documents and financing documents The precise description of the categories of data can be found under LTSE’s services description site xxxxx://xxxx.xxx/tools/gdpr-services. Special categories of data (if appropriate) The personal data transferred concern the following special categories of data: Data exporter may submit Personal Data to LTSE, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include the following special categories of Personal Data: • Ethnicity Processing operations The objective of Processing of Personal Data by the data importer is the performance of the Service LTSE pursuant to the Master Subscription Agreement. DATA EXPORTER Name…….……………………………… Authorised Signature …………………… DATA IMPORTER LTSE processes personal data, inter alia, to provide company management, financial planning, employee management, professional education, and related services, such as assist with record keeping, provide guidance, and visualize data. Details regarding subject, duration, scope, type and purpose of the processing are set out in more detail on LTSE’s services description site xxxxx://xxxx.xxx/tools/gdpr- services. The LTSE services description published at xxxxx://xxxx.xxx/tools/gdpr-services shall at the time of signing be added to this Agreement in hard copy and otherwise be hereby incorporated by reference. Changes thereof will be notified to Customer and deemed accepted unless objected by Customer with 30 days’ notice following receipt of notification. Customer shall only be entitled to object to a change to the extent such change affects compliance with applicable data protection law or data security. On behalf of the Data Exporter(s): On behalf of the Data Importer: [ ] LTSE Services, Inc. Signature: Signature: Print Name: Xxx Xxxxxx Authorised Signature APPENDIX 2 TO THE STANDARD CONTRACTUAL CLAUSES This Appendix forms part of the Clauses and must be completed and signed by the parties.Print Name: Xxxx Xxxx Print Title: Print Title: CEO Date: Date:

TO THE STANDARD CONTRACTUAL CLAUSES. This Appendix forms part of the Clauses and must be completed and signed by the parties. The Member States may complete or specify, according to their national procedures, any additional necessary information to be contained in this Appendix. Data exporter The Each data exporter is (please specify briefly your activities relevant either a member of the Customer group of companies whose ultimate parent company is Customer, Inc, or a subscriber of Customer's Service. The Customer group of companies provides and operates the Service. Each data exporter wishes to appoint the transfer): Data exporter is data importer to provide it with data processing services. The role of the legal entity data importer, the nature of the data processing services it will provide, the categories of data that has executed it will process, and the Data Processing Addendum based on protections it will apply to protect those data are set out in the Standard Contractual Clauses as a Data Exporter established within the European Economic area Appendices 1 and Switzerland that have purchased the Service on the basis of one or more Order Form(s)2 to these Clauses. Data importer The data importer is (please specify briefly activities relevant to the transfer): Data importer, Okta, Inc., is an identity and access management cloud A service provider which Processes processes Personal Data, where such data is Customer Data, Data upon the instruction of the data exporter in accordance with the terms of the Agreement agreement between Customer and data importer relating to the Data Processing Addendumprovision of services by data importer to Customer. Data subjects The personal data transferred concern the following categories of data subjects (please specify): Data exporter may submit transfer Personal Data to the Servicedata importer, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include, but is not limited to Personal Data relating to the following categories of data subjects: • CustomersProspects, customers, business partners, partners and vendors of the data exporter (who are natural persons) ); • Employees or contact persons of data exporter exporter’s prospects, customers, business partners, partners and vendors vendors; and • Employees, agents, advisors, contractors, or any user authorized by the freelancers of data exporter to use the Service (who are natural persons) ). Categories of data The Personal Data personal data transferred concern the following categories of data (please specify): Data exporter may submit transfer Personal Data to the Servicedata importer, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include, but is not limited to the following categories of personal dataPersonal Data: • First and last name • Business contact Title • Position • Employer • Contact information (company, email, phone, physical business address) • Personal contact information (email, cell phone) • Title • Position • Employer • ID data • Professional life data • Personal life data (in the form of security questions and answersincluding but not limited to home addressed, personal phone numbers, resumes, attendance records, bank details) • Connection data • Localization Localisation data Special categories of data (if appropriate) The Personal Data personal data transferred concern the following special categories of data (please specify): Data exporter may submit special categories of data to the Service, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include Personal Data concerning health information. N/A Processing operations The Personal Data personal data transferred will be subject to the following basic processing activities (please specify): The objective of Processing of Personal Data by the data importer is the performance of the Service data importer’s services pursuant to the Master Subscription Agreementagreement between Customer and the data importer relating to the provision of services by the data importer to Customer. DATA EXPORTER Name…….……………………………… Authorised Signature …………………… DATA IMPORTER Name: Xxx Xxxxxx Authorised Signature APPENDIX Appendix 2 TO THE STANDARD CONTRACTUAL CLAUSES to the Standard Contractual Clauses This Appendix forms part of the Clauses and must be completed and signed by the parties.. Description of the technical and organizational security measures implemented by the data importer in accordance with Clauses 4(d) and 5(c) (or document/legislation attached):

TO THE STANDARD CONTRACTUAL CLAUSES. This Appendix forms part of the Clauses and must be completed and signed by the parties. The Member States may complete or specify, according to their national procedures, any additional necessary information to be contained in this Appendix. Data exporter The data exporter is (please specify briefly your activities relevant to the transfer): Data exporter Exporter is (i) the legal entity that has executed the Data Processing Addendum based on the Standard Contractual Clauses as a Data Exporter and, (ii) all Affiliates (as defined in the Agreement) of Customer established within the European Economic area Area (EEA) and Switzerland that have purchased the Service Services on the basis of one or more Order Form(s). Data importer The data importer is (please specify briefly activities relevant to the transfer): Data importerCompany is a provider of cloud data storage, Okta, Inc., is an identity and access management cloud service provider which Processes Personal Data, where such processes personal data is Customer Data, upon the instruction of the data exporter in accordance with the terms of the Agreement and the Data Processing AddendumAgreement. Data subjects The personal data transferred concern the following categories of data subjects (please specify): Data exporter may submit Personal Data to the ServiceServices, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include, but is not limited to Personal Data relating to the following categories of data subjects: • Customers, business partners, and vendors of the data exporter (who are natural persons) • ● Customers ● Employees or contact persons of data exporter customers, business partners, and vendors • Employees, agents, advisors, contractors, or any user authorized by the data exporter to use the Service (who are natural persons) ● Suppliers ● End-users Categories of data The Personal Data personal data transferred concern the following categories of data (please specify): Data exporter may submit Personal Data to the ServiceServices, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include, but is not limited to the following categories of personal dataPersonal Data: • First and last name • Business contact information (company, email, phone, physical business address) • Personal contact information (email, cell phone) • Title • Position • Employer • ID data • Professional life data • Personal life data (in the form of security questions and answers) • Connection data • Localization data ● Customers ● Employees ● Suppliers ● End-users Special categories of data (if appropriate) The Personal Data personal data transferred concern the following special categories of data (please specify): Data exporter may submit special categories of data to the Service, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include Personal Data concerning health information. Processing operations The Personal Data personal data transferred will be subject to the following basic processing activities (please specify): The objective of Processing of Personal Data by the data importer is the performance of the Service Services pursuant to the Master Subscription Agreement. DATA EXPORTER DATA IMPORTER Name…….:………………………………… Authorised …….… Name:………………………………….… Authorized Signature …………………… DATA IMPORTER Name: Xxx Xxxxxx Authorised Authorized Signature APPENDIX 2 TO THE STANDARD CONTRACTUAL CLAUSES This Appendix forms part of the Clauses and must be completed and signed by the parties.……………………

TO THE STANDARD CONTRACTUAL CLAUSES. This Appendix forms part of the Clauses and must be completed and signed by the parties. parties The Member States may complete or specify, according to their national procedures, any additional necessary information to be contained in this Appendix. Appendix Data exporter The data exporter is (please specify briefly your activities relevant to the transfer): Data exporter is the Customer legal entity that has executed entered into these terms with the Data Processing Addendum based on Company and receives services from the Standard Contractual Clauses as a Data Exporter established within the European Economic area and Switzerland that have purchased the Service on the basis of one or more Order Form(s)Company. Data importer The data importer is (please specify briefly activities relevant the Company legal entity that has entered into these terms, which is a software company that processes personal data as part of the services provided to the transfer): Data importer, Okta, Inc., is an identity and access management cloud service provider which Processes Personal Data, where such data is Customer Data, upon the instruction of the data exporter in accordance with the terms of the Agreement and the Data Processing Addendumthis agreement. Data subjects The personal data transferred concern the following categories of data subjects (please specify): Data exporter subjects: Customer may submit Personal Data personal data to Company to enable Company to provide the ServiceDisplayr software, the extent of which is determined and controlled by the data exporter Customer in its sole discretion, and which may include, but is not limited to Personal Data relating to the following categories of data subjects: • Customers, business partners, and vendors of the data exporter Customer (who are natural persons) • Employees or contact persons of data exporter Customer customers, business partners, and vendors • Employees, agents, advisors, contractors, or any user authorized by the data exporter Customer to use the Service Displayr software (who are natural persons) • Any other persons whose personal data the Customer choose to upload to the Displayr platform Categories of data The Personal Data personal data transferred concern the following categories of data: Company has no control over the categories of data (please specify): Data exporter may submit Personal Data that Customer uploads to the Service, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may includeDisplayr platform, but it is not limited anticipated to include the following categories of personal data: • First Full names and last name usernames • Business contact Addresses • Contact information (companyemails, emailaddresses, phone, physical business addressphone numbers) • Personal contact information (emailIP addresses, cell phone) device MAC addresses • Title Any other personal identifiers • Position • Employer • ID data • Professional life data • Personal life data (in the form of security questions Employment and answers) • Connection data • Localization data education associations and history Special categories of data (if appropriate) The Personal Data personal data transferred concern the following special categories of data (please specify): Data exporter may submit Company has no control over the categories of data that Customer uploads to the Displayr platform, but it is anticipated to include the following special categories of data: • personal data to the Servicerevealing racial or ethnic origin, the extent of which is determined and controlled by the data exporter in its sole discretionpolitical opinions, religious or philosophical beliefs, or trade union membership, and which may include Personal Data the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health information. or data concerning a natural person's sex life or sexual orientation Processing operations The Personal Data personal data transferred will be subject to the following basic processing activities (please specify): The objective activities: Company will process personal data as necessary to provide the Displayr software service, as further instructed by Customer in the course of Processing of Personal Data by the data importer is the performance its use of the Service pursuant to the Master Subscription Agreement. DATA EXPORTER Name……service.……………………………… Authorised Signature …………………… DATA IMPORTER Name: Xxx Xxxxxx Authorised Signature APPENDIX 2 TO THE STANDARD CONTRACTUAL CLAUSES This Appendix forms part of the Clauses and must be completed and signed by the parties.

TO THE STANDARD CONTRACTUAL CLAUSES. This Appendix forms part of the Standard Contractual Clauses and must be completed and signed by the parties. The Member States may complete or specify, according to their national procedures, any additional necessary information to be contained in this Appendix. Appendix Data exporter The data exporter is: The Customer which is (please specify briefly your activities relevant subject to the transfer): Data exporter is Protection Laws of the legal entity that has executed the Data Processing Addendum based on the Standard Contractual Clauses as a Data Exporter established within European Union, the European Economic area and Area, Switzerland that have purchased and/or the Service on the basis of one or more Order Form(s)United Kingdom together with any Authorized Affiliates. Data importer The data importer is (please specify briefly activities relevant to the transfer): Data importer, Oktais: PROS, Inc., is an identity a provider of software as a service solutions and access management cloud service provider which Processes Personal Data, where such related professional services. Data subjects and Categories of data is Customer Data, upon Data exporter may submit personal data to the instruction Subscription Service and/or as part of the Professional Services, the extent of which is determined and controlled by data exporter in accordance with its sole discretion. Depending on the terms use case, this may include, but is not limited to, the following categories of personal data and data subjects: Selling & Pricing Solutions Subscription Service Categories of Personal Data Categories of data subjects PROS Smart CPQ • User log-in ID and credentials • Online identifiers (IP address) • First and last name • Title and Position • Employer • Contact information (company, email, business address or phone number) Users of the Agreement Subscription Service • First and last name • Title and Position • Employer • Contact information (company, email, physical business or residential address, phone number) • Where applicable, certain Personal Life Data to the extent necessary to perform the configure, quote process Prospects and customers of Customer and Customer Affiliates • PROS Control • User log-in ID and credentials • Location data (time zone, location/language preferences) • Online identifiers (IP address) • First and last name • Title, Position and Employee ID • Employer • Contact information (company, email, physical business address, phone number) • PROS Guidance • PROS Integrate • PROS Real-Time Pricing Engine (RTPE) Users of the Subscription Service • PROS Opportunity Detection • User log-in ID and credentials PROS Contribution Management System (CMS) • First and last name • Title and position • Employer Users of the Subscription Service • Email address Travel Solutions Subscription Service Categories of Personal Data Processing AddendumCategories of data subjects • PROS RM Advantage • PROS RM Essentials • PROS RM Essentials Network Add- On • PROS Market Valuation Module (MVM) • First and last name • Employer • Title and Position • Email address • User log-in ID and credentials Users of the Subscription Service PROS Group Sales Optimizer (GSO) • First and last name • Employer • Title and Position • User log-in ID and credentials • Contact information (company, email, physical business address, phone number) Users of the Subscription Service Customer (and Customer Affiliates’) business partners and resellers, as well as their employees and other related persons • First and last name • Date of birth • PNR locator (booking reference number) • Travel information (e.g., destination, fare information, travel status) Prospects and customers of Customer and Customer Affiliates • PROS Real-Time Dynamic Pricing (RTDP) Advantage • PROS Real-Time Dynamic Pricing (RTDP) Ultimate • First and last name • Employer • Email address • User log-in ID and credentials Users of the Subscription Service • First and last name • Title and Position • Employer • Email address • User log-in ID and credentials Users of the Subscription Service Customer (and Customer Affiliates’) business partners and resellers, as well as their employees and other related persons • PROS OneSearch • Frequent flyer program details (e.g., miles accumulated, passenger score/tier level) • This Subscription Service also processes other personal information - such as date of birth, gender and country of citizenship and residence - however this data does not fall within the definition of Personal Data as it does not relate to natural persons who: (i) can be identified or who are identifiable, directly from the data; or (ii) can be indirectly identified from the data in combination with other information. Data subjects • PROS OneSearch – Groups • PROS Merchandising • PROS FastSearch Prospects and customers of Customer and Customer Affiliates PROS Repricer • First and last name • Employer • Title and Position • Email address • User log-in ID and credentials Users of the Subscription Service Customer (and Customer Affiliates’) business partners and resellers, as well as their employees and other related persons • Date of birth • Travel information (e.g., destination) Prospects and customers of Customer and Customer Affiliates PROS Pricing Cache • First and last name • Employer • Title and Position • Email address • User log-in ID and credentials Users of the Subscription Service Customer (and Customer Affiliates’) business partners and resellers, as well as their employees and other related persons PROS Retail for Airlines • First and last name • Email address & telephone number • Date of birth (for minors only) • Meal preferences • Health data if relevant to travel requirements • Certain additional information, which will depend on destination (e.g., gender, date of birth, travel document number, issue country, personal identifiers • Online identifiers (IP address, website clicks) Users of the Subscription Service, which include prospects and customers of Customer and Customer Affiliates Special categories of data (if appropriate) The personal data transferred concern the following special categories of data subjects (please specify): data: This will depend on the use case for the Subscription Service. Data exporter may submit Personal Data special categories of data to the ServiceSubscription Service and/or as part of the Professional Services, the extent of which is determined and controlled by the data exporter in its sole discretiondiscretion For the sake of clarity, special category data is Personal Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade-union membership, genetic data, and which may include, but is not limited to Personal Data relating to the following categories of biometric data subjects: • Customers, business partners(where used for identification purposes), and vendors of the data exporter (who are natural persons) • Employees concerning health, a person’s sex life or contact persons of data exporter customers, business partners, and vendors • Employees, agents, advisors, contractors, or any user authorized by the data exporter to use the Service (who are natural persons) Categories of data The Personal Data transferred concern the following categories of data (please specify): Data exporter may submit Personal Data to the Service, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include, but is not limited to the following categories of personal data: • First and last name • Business contact information (company, email, phone, physical business address) • Personal contact information (email, cell phone) • Title • Position • Employer • ID data • Professional life data • Personal life data (in the form of security questions and answers) • Connection data • Localization data Special categories of data (if appropriate) The Personal Data transferred concern the following special categories of data (please specify): Data exporter may submit special categories of data to the Service, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include Personal Data concerning health informationsexual orientation. Processing operations The Personal Data personal data transferred will be subject to the following basic processing activities: Processing activities (please specify): The objective of Processing of Personal Data by will be limited to those necessary to provide the data importer is the performance of the Subscription Service and Professional Services pursuant to the Master Subscription Agreement. DATA EXPORTER Name…….……………………………… : _ Authorised Signature …………………… DATA IMPORTER Name: Xxx Xxxxxx Xxxxxxx Authorised Signature APPENDIX 2 TO THE STANDARD CONTRACTUAL CLAUSES This Appendix forms part of the Clauses and must be completed and signed by the parties.Signature

TO THE STANDARD CONTRACTUAL CLAUSES. This Appendix forms part of the Clauses and must be completed and signed by the parties. The Member States may complete or specify, according to their national procedures, any additional necessary information to be contained in this Appendix. Data exporter The data exporter is (please specify briefly your activities relevant to the transfer): Data exporter is the legal entity that has executed the Data Processing Addendum based on the Standard Contractual Clauses as a Data Exporter established within the European Economic area and Switzerland that have purchased the Service on the basis of one or more Order Form(s). Data importer The data importer is (please specify briefly activities relevant to the transfer): Data importer, Okta, Inc., is an identity and access management cloud service provider which Processes Personal Data, where such data is Customer Data, upon the instruction of the data exporter in accordance with the terms of the Agreement and the Data Processing Addendum. Data subjects The personal data transferred concern the following categories of data subjects (please specify): Data exporter may submit Personal Data to the Service, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include, but is not limited to Personal Data relating to the following categories of data subjects: • Customers, business partners, and vendors of the data exporter (who are natural persons) • Employees or contact persons of data exporter customers, business partners, and vendors • Employees, agents, advisors, contractors, or any user authorized by the data exporter to use the Service (who are natural persons) Categories of data The Personal Data transferred concern the following categories of data (please specify): Data exporter may submit Personal Data to the Service, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include, but is not limited to the following categories of personal data: • First and last name • Business contact information (company, email, phone, physical business address) • Personal contact information (email, cell phone) • Title • Position • Employer • ID data • Professional life data • Personal life data (in the form of security questions and answers) • Connection data • Localization data Special categories of data (if appropriate) The Personal Data transferred concern the following special categories of data (please specify): Data exporter may submit special categories of data to the Service, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include Personal Data concerning health information. Processing operations The Personal Data transferred will be subject to the following basic processing activities (please specify): The objective of Processing of Personal Data by the data importer is the performance of the Service pursuant to the Master Subscription Agreement. DATA EXPORTER Name…….:……………………………… Authorised Signature …………………… DATA IMPORTER Name: Xxx Xxxxxx Authorised Signature APPENDIX 2 TO THE STANDARD CONTRACTUAL CLAUSES This Appendix forms part of the Clauses and must be completed and signed by the parties.

TO THE STANDARD CONTRACTUAL CLAUSES. This Appendix forms part of the Clauses and must be completed and signed by the parties. parties The Member States may complete or specify, according to their national procedures, any additional necessary information to be contained in this Appendix. Appendix Data exporter The data exporter Data Exporter is (please specify briefly your activities relevant to the transfer): Data exporter is i) the legal entity that has executed the Data Processing Addendum based on the Standard Contractual Clauses as a Data Exporter and, (ii) all Affiliates of Customer established within the European Economic area Area (EEA) and Switzerland that have purchased the Service Dubsado Services on the basis of one or more Order Form(s). Data importer The data importer is (please specify briefly activities relevant to the transfer): Data importer, Okta, Inc., Dubsado is an identity online client management system, business management suite and access management cloud service provider workflow automation system which Processes Personal Data, where such processes personal data is Customer Data, upon the instruction of the data exporter in accordance with the terms of the Agreement and the Data Processing AddendumAgreement. Data subjects The personal data transferred concern the following categories of data subjects (please specify): Data exporter may submit Personal Data to the ServiceDubsado, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include, but is not limited to Personal Data relating to the following categories of data subjects: • CustomersLeads, customers, business partners, partners and vendors of the data exporter (who are natural persons) • Employees or contact persons of data exporter exporter’s prospects, customers, business partners, partners and vendors • Employees, agents, advisors, contractors, or any user authorized by the freelancers of data exporter to use the Service (who are natural persons) Data exporter’s • Users authorized by data exporter to use Dubsado. Categories of data The Personal Data transferred concern the following categories of data (please specify): Data exporter may submit Personal Data to the ServiceDubsado, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include, but is not limited to the following categories of personal dataPersonal Data: • First and last name • Business contact Title • Position • Employer • Contact information (company, email, phone, physical business address) • Personal contact information (email, cell phone) • Title • Position • Employer • ID data • Professional life data • Personal life data (in the form of security questions and answers) • Connection data • Localization Localisation data • Legal Instruments • Email Data Special categories of data (if appropriate) The Personal Data transferred concern the following special categories of data (please specify): Data exporter may submit special categories of data to the ServiceDubsado, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include is for the sake of clarity Personal Data with information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, and the processing of data concerning health informationor sex life. Processing operations The Personal Data personal data transferred will be subject to the following basic processing activities (please specify): The objective of Processing of Personal Data by the data importer is the performance of the Service Dubsado pursuant to the Master Subscription Agreement. DATA EXPORTER Name…….:……………………………… Authorised Authorized Signature …………………… DATA IMPORTER Name: Xxx Xxxxxx Authorised Xxxxx Xxxx Authorized Signature …………………… Date: 5/18/2018 APPENDIX 2 TO THE STANDARD CONTRACTUAL CLAUSES This Appendix forms part of the Clauses and must be completed and signed by the parties.. Description of the technical and organizational security measures implemented by the data importer in accordance with Clauses 4(d) and 5(c):

TO THE STANDARD CONTRACTUAL CLAUSES. This Appendix forms part of the Clauses and must be completed and signed by the parties. parties The Member States may complete or specify, according to their national procedures, any additional necessary information to be contained in this Appendix. Data exporter The data exporter is (please specify briefly your activities relevant to the transfer): Data exporter Exporter is (i) the legal entity that has executed the Data Processing Addendum based on the Standard Contractual Clauses as a Data Exporter and, (ii) all Affiliates (as defined in the Agreement) of Customer established within the European Economic area Area (EEA) and Switzerland that have purchased the Service on the basis of one or more Order Form(s)SCC Services. Data importer The data importer is (please specify briefly activities relevant to the transfer): Data importer, Okta, Inc., Snappic Incorporated is an identity a provider of marketing and access management cloud service provider advertising solutions which Processes Personal Data, where such processes personal data is Customer Data, upon the instruction of the data exporter in accordance with the terms of the Agreement and the Data Processing AddendumAgreement. Data subjects The personal data transferred concern the following categories of data subjects (please specify): Data exporter may submit Personal Data to the ServiceSCC Services, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include, but is not limited to Personal Data relating to the following categories of data subjects: • CustomersProspects, customers, business partners, partners and vendors of the data exporter (who are natural persons) • Employees or contact persons of data exporter exporter’s prospects, customers, business partners, partners and vendors • Employees, agents, advisors, contractors, or any user authorized by the freelancers of data exporter to use the Service (who are natural persons) Data exporter’s Users authorized by data exporter to use the SCC Services Categories of data The Personal Data personal data transferred concern the following categories of data (please specify): Data exporter may submit Personal Data to the ServiceSCC Services, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include, but is not limited to the following categories of personal dataPersonal Data: • ● First and last name • Business contact ● Title ● Position ● Contact information (company, email, phone, physical business address) • Personal contact ● Credit card information (email, cell phone) • Title • Position • Employer • ID data • Professional life data • ● Personal life data (in the form of security questions and answers) • ● Connection data • Localization ● Localisation data Special categories of data (if appropriate) The Personal Data personal data transferred concern the following special categories of data (please specify): Data exporter may submit special categories of data to the Service, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include Personal Data concerning health information. Not applicable Processing operations The Personal Data personal data transferred will be subject to the following basic processing activities (please specify): The objective of Processing of Personal Data by the data importer is the performance of the Service SCC Services pursuant to the Master Subscription Agreement. DATA EXPORTER Name…….……………………………… Authorised Signature …………………… : Authorized Signature: DATA IMPORTER Name: Xxx Xxxxxx Authorised Signature Xxxxx Xxxxxxxx Authorized Signature: APPENDIX 2 TO THE STANDARD CONTRACTUAL CLAUSES This Appendix forms part of the Clauses and must be completed and signed by the parties.parties Description of the technical and organisational security measures implemented by the data importer in accordance with Clauses 4(d) and 5(c) (or document/legislation attached): Data importer will maintain administrative, physical, and technical safeguards for protection of the security, confidentiality and integrity of Personal Data uploaded to the SCC Services, as described in the Security, Privacy and Architecture Documentation applicable to the specific SCC Services purchased by data exporter, and accessible via xxxxx://xxx.xxxxxxx.xx or otherwise made reasonably available by data importer. Data Importer will not materially decrease the overall security of the SCC Services during a subscription term. DATA EXPORTER Name: Authorized Signature: DATA IMPORTER Name: Xxxxx Xxxxxxxx Authorized Signature: APPENDIX 3 TO THE STANDARD CONTRACTUAL CLAUSES

TO THE STANDARD CONTRACTUAL CLAUSES. ‌ This Appendix forms part of the Clauses and must be completed and signed by the parties. parties The Member States may complete or specify, according to their national procedures, any additional necessary information to be contained in this Appendix. Appendix Data exporter The data exporter is (please specify briefly your activities relevant to the transfer): Data exporter Exporter is (i) the legal entity that has executed the Data Processing Addendum based on the Standard Contractual Clauses as a Data Exporter and, (ii) all Affiliates (as defined in the Agreement) of Customer established within the European Economic area Area (EEA) and Switzerland that have purchased the Service SCC Services on the basis of one or more Order Form(s). Data importer The data importer is (please specify briefly activities relevant to the transfer): Data importer, Okta, Inc., eGain Corporation is an identity and access management a provider of enterprise cloud service provider computing solutions which Processes Personal Data, where such processes personal data is Customer Data, upon the instruction of the data exporter in accordance with the terms of the Agreement Agreement. eGain Corporation also develops and supplies customer engagement solutions including chat, web self service, knowledge agent, and click-to-call on premise and in the Data Processing Addendumcloud to businesses in various industries. Data subjects The personal data transferred concern the following categories of data subjects (please specify): Data exporter may submit Personal Data to the ServiceSCC Services, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include, but is not limited to Personal Data relating to the following categories of data subjects: • CustomersProspects, customers, business partners, partners and vendors of the data exporter (who are natural persons) • Employees or contact persons of data exporter exporter’s prospects, customers, business partners, partners and vendors • Employees, agents, advisors, contractors, or any user authorized by the freelancers of data exporter to use the Service (who are natural persons) • Data exporter’s Users authorized by data exporter to use the SCC Services Categories of data The Personal Data personal data transferred concern the following categories of data (please specify): * If in performing the SCC Services for data exporter, the data importer determines that personal data transferred concern additional categories of data not listed above, such additional categories of data will also be covered by this ADDENDUM. Data exporter may submit Personal Data to the ServiceSCC Services, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include, but is not limited to the following categories of personal dataPersonal Data: • First and last name • Business contact information (company, email, phone, physical business address) • Personal contact information (email, cell phone) • Title • Position • Employer • Contact information (email, phone, physical address, IP address) • ID data • Professional professional life data • Personal personal life data (in the form of security questions and answers) • Connection connection data • Localization localisation data • application logs • channel sessions including email, chat and cobrowse Special categories of data (if appropriate) The Personal Data personal data transferred concern the following special categories of data (please specify): Data exporter may submit special categories of data to the ServiceSCC Services, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include is for the sake of clarity Personal Data with information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade- union membership, and the processing of data concerning health informationor sex life. Processing operations The Personal Data personal data transferred will be subject to the following basic processing activities (please specify): The objective of Processing of Personal Data by the data importer is the performance of the Service SCC Services pursuant to the Master Subscription AgreementAgreement and for troubleshooting of customer systems and applications including testing and debugging, perform configuration, customization, installation, integration, simulation and backup operations, test version to version upgrades, data analytics. DATA EXPORTER Name…….……………………………… : Authorised Signature …………………… DATA IMPORTER Name: Xxx Xxxxxx Xxxx Xxxx Authorised Signature APPENDIX 2 TO THE STANDARD CONTRACTUAL CLAUSES This Appendix forms part of the Clauses and must be completed and signed by the parties.Signature

TO THE STANDARD CONTRACTUAL CLAUSES. This Appendix forms part of the Clauses and must be completed and signed by the parties. The Member States may complete or specify, according to their national procedures, any additional necessary information to be contained in this Appendix. Data exporter The data exporter is , (please specify briefly your activities relevant to the transfer): Data exporter is the legal entity that “Customer”) who has executed the Data Processing Addendum based on the Standard Contractual Clauses as a Data Exporter established within the European Economic area and Switzerland that have purchased the Service on the basis of one or more Order Form(s)Principal Agreement with Hevo. Data importer The data importer is (please specify briefly activities relevant to the transfer): Data importer, Okta, Inc., is an identity and access management cloud service provider which Processes Personal Hevo Data, where such data is Customer Data, upon the instruction of the data exporter in accordance with the terms of the Agreement and the Data Processing AddendumInc. (“Hevo”). Data subjects The personal data transferred concern the following categories of data subjects (please specify): subjects: Data exporter may submit or share Personal Data to the ServiceData, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include, but is not limited to Personal Data relating to the following categories of data subjectsData Subjects: • Customers● Prospects, customers, business partners, partners and vendors of the data exporter (who are natural persons) • exporter. ● Employees or contact persons of data exporter exporter’s prospects, exporter’s customers, exporter’s business partners, partners and vendors • exporter’s vendors. ● Employees, agents, advisors, contractors, or any user freelancers of data exporter. ● Data exporter’s affiliates authorized by the data exporter to use the Service (who are natural persons) Service. Categories of data The Personal Data personal data transferred concern the following categories of data (please specify): data: Data exporter may submit Personal Data to the Service, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include, but is not limited to the following categories of personal data: • First and last name • Business contact information (company, email, phone, physical business address) • Personal contact information (email, cell phone) • Title • Position • Employer • ID data • Professional life data • Personal life data (in the form of security questions and answers) • Connection data • Localization data Special categories of data (if appropriate) The Personal Data transferred concern the following special categories of data (please specify): Data exporter may submit special categories of data to the Service, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include but is not limited to the following categories of Personal Data: ● First and Last Name; ● Contact Information including email address, phone number, social media profiles; ● Professional life data including employer, designation; ● Personal life data including salutation, marital status, family details etc.; ● Locational data; ● Data concerning health available on social media (e.g., Facebook, Twitter, etc.) profiles, status and information; ● Event and survey registration, attendance, and response data; ● Engagement data, namely, articles, posts, and the like that is “followed”, “liked” or “disliked”; ● Internet cookies; ● Communication data like emails, chat, voicemail etc. Also, includes feedback and support related communication data; and ● Comments and posts submitted to websites, mobile apps, and online communities Special categories of data (if appropriate) The Customer may submit special categories of data on the platform operated by Hevo. However, Hevo does not have access to this, as it is always in encrypted form. Processing operations The Personal Data personal data transferred will be subject to the following basic processing activities (please specify): The objective of Processing of Personal activities: Data by the importer will process personal data importer is the performance of as necessary to provide the Service pursuant to the Master Subscription Principal Agreement, and as further instructed by data exporter in its use of the Service. This includes automated extraction of data from data exporter’s data sources, transformation of data as per data exporter’s requirement, and loading data into data exporter’s destination database/data warehouse. DATA EXPORTER [Populated with details of, and deemed to be signed on behalf of, the data exporter:] Name…….:……………………………… Signed by: Position: Authorised Signature …………………… Date: DATA IMPORTER Name: Xxx Xxxxxx Hevo Data, Inc. Signed by: Position: Authorised Signature APPENDIX 2 TO THE STANDARD CONTRACTUAL CLAUSES This Appendix forms part of the Clauses and must be completed and signed by the parties.…………………… Date:

TO THE STANDARD CONTRACTUAL CLAUSES. This Appendix forms part of the Clauses and must be completed and signed by the parties. parties The Member States may complete or specify, according to their national procedures, any additional necessary information to be contained in this Appendix. Appendix Data exporter The data exporter is (please specify briefly your activities relevant to the transfer): Data exporter is the legal entity that has executed the Data Processing Addendum based on the Standard Contractual Clauses as a Data Exporter established within data exporter and all clients and affiliates thereof who process personal data of subjects located in the European Economic area EEA, Switzerland, and Switzerland that have purchased the Service on the basis of one or more Order Form(s)United Kingdom. Data importer The data importer is (please specify briefly activities relevant to the transfer): Data importerDeveloper and publisher of online marketing information, Okta, Inc., is an identity services and access management cloud service provider automation software which Processes Personal Data, where such involves processing personal and customer data is Customer Data, upon the instruction of provided by the data exporter in accordance with the terms of the Agreement Standard Contractual Clauses (SCC) and the Data Processing AddendumSA including all related orders between the data exporter and data importer. Data subjects The personal data transferred concern the following categories of data subjects (please specify): Data exporter The categories and types of data subjects who may submit Personal Data to be processed in accordance with the Service, the extent of which is client agreement are determined and controlled by the data exporter in its sole discretionand may include but are not limited to: Prospects (leads), customers, contacts, website visitors, and which may include, but is not limited to Personal Data relating to the following categories of data subjects: • Customers, business partners, and vendors contractors of the data exporter exporter; and Prospects (who are natural persons) • Employees leads), website visitors, employees or contact persons contractors of data exporter customers, business partners, and vendors • Employees, agents, advisors, contractors, or any user authorized by the data exporter to use the Service (who are natural persons) exporters’ customers and clients. Categories of data The Personal Data personal data transferred concern the following categories of data (please specify): Data exporter may submit Personal Data to the Service, the extent The categories of which is personal data are determined and controlled by the data exporter in at its sole discretion, in accordance with the SA, and which may include, include but is are not limited to the following categories of personal datato: • First and last name • Business name, contact information (companye.g. email address, email, phonephone number, physical business address) • Personal contact localization data, geographical data, device identification data, business network and experience, financial data, educational data, interests, information collected through cookies (emailas denoted on our Cookie Policy xxxxx://xxxxxxxxxxx.xxx/legal/sharpspring-cookie-policy/), cell phone) • Title • Position • Employer • ID data • Professional life data • Personal life data from exporters’ connected social media accounts as authorized by the exporter, and information received from third parties (in the form of security questions and answers) • Connection data • Localization data as applicable). Special categories of data (if appropriate) The Personal Data personal data transferred concern the following special categories of data (please specify): Data The data exporter may submit and data importer do not anticipate the transfer of special categories of data. Restrictions of this type of data to are defined in the SA and/or Terms of Service, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include Personal Data concerning health information. Processing operations The Personal Data transferred will be subject to the following basic processing activities (please specify): The objective of Processing of Personal Data by the data importer is the performance of the Service pursuant to the Master Subscription Agreement. DATA EXPORTER Name…….……………………………… Authorised Signature …………………… DATA IMPORTER Name: Xxx Xxxxxx Authorised Signature APPENDIX 2 TO THE STANDARD CONTRACTUAL CLAUSES This Appendix forms part of the Clauses and must be completed and signed by the parties.