DATA PROCESSING AGREEMENT

1. To the extent legally required, by agreeing to this DPA, Customer and Apryse are deemed to have signed the SCCs as an additional safeguard, which form part of this DPA and will be deemed completed as follows:
   1. Module 2 of the EU SCCs applies to transfers of Personal Data from Customer (as a Controller) to Apryse (as a Processor) and Module 3 applies to transfers of Personal Data from Customer (as a Processor) to Apryse (as a Subprocessor);
   2. Clause 7 (the optional docking clause) is included;
   3. Under Clause 9 (Use of Subprocessors), the Parties select Option 2 (General written authorization);
   4. Under Clause 11 (Redress), the optional language requiring that Data Subjects be permitted to lodge a complaint with an independent dispute resolution body shall not be deemed to be included;
   5. Under Clause 17 (Governing law), the Parties choose Option 1 (the law of an EU Member State that allows for third-Party beneficiary rights). The Parties select the laws of Ireland;
   6. Under Clause 18 (Choice of forum and jurisdiction), the Parties select the courts of Ireland;
   7. Annex I(A) and I(B) is completed as follows:
      1. LIST OF PARTIES
         
         

         Data exporter(s):

         
         

         The exporter (Controller) is Customer and Customer’s contact details and signature are as provided in the Agreement and the DPA.

         
         

         Data importer(s):

         
         

         The importer (Processor) is Apryse and Apryse’s contact details and signature are as provided in the Agreement and the DPA.

         
         
      2. DESCRIPTION OF TRANSFER
         
         

         Categories of data subjects whose personal data is transferred:

         
         

         Any data subjects whose Personal Data is contained in Customer data being used in the Services, as set out in the Agreement which describes the provision of Services to Customer, which may include Customer’s authorized users, representatives, and end users, including, without limitation, Customer’s employees, contractors, partners, suppliers, customers, and clients.

         
         

         Categories of personal data transferred:

         
         

         Any Personal Data that is provided by Customer to Apryse in connection with the Agreement, as described further in the DPA, including, without limitation, contact information such as name, address, telephone or mobile number, email address, and passwords.

         
         

         Sensitive data transferred (if applicable): N/A.

         
         

         The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis):

         
         

         On a continuous basis as needed to provide the Services to Customer for the term of the Agreement.

         
         

         Nature of the processing:

         
         

         The nature of the Processing is set out in the Agreement between the parties.

         
         

         Purpose(s) of the data transfer and further processing:

         
         

         The purposes of the data transfer are for Apryse to provide the Services pursuant to the Agreement.

         
         

         The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period:

         
         

         The data will be retained for the time period needed to accomplish the purposes of Processing, unless otherwise required by applicable law.

         
         
   8. Under Annex I(C) (Competent supervisory authority), the Parties shall follow the rules for identifying such authority under Clause 13 and, to the extent legally permissible, select the Irish Data Protection Commission;
   9. Annex II (Technical and organizational measures) is completed as provided the DPA; and
   10. Annex III (List of Subprocessors) is not applicable as the Parties have chosen General Authorization under Clause 9, however Apryse’s Sub-processor list can be viewed as described in Section 7 above.
2. With respect to Personal Data transferred from the United Kingdom, for which the United Kingdom Data Protection Act of 2018 (“UK GDPR”) governs the international nature of the transfer, the International Data Transfer DPA to the SCCs (available as of the Effective Date at https://ico.org.uk/media/for-organisations/documents/4019539/international-data-transfer-addendum.pdf  (“UK SCCs”) forms part of this DPA and takes precedence over the rest of this DPA as set forth in the UK SCCs. Undefined capitalized terms used in this provision shall mean the definitions in the UK SCCs. The UK SCCs shall be deemed complete as follows: (a) the Parties’ details shall be the Parties and their Affiliates to the extent any of them are involved in such transfer; (b) the Key Contacts shall be the contacts set forth in the Agreement; (c) the Approved SCCs referenced in Table 2 shall be the SCCs as executed by the Parties; (d) either Party may end this DPA as set out in Section 19 of the UK SCCs; and (e) by entering into this DPA, the Parties are deemed to be signing the UK SCCs.