Data Processing Addendum

1. Definitions

   1. “Anonymous Data” means Personal Data that has been processed in such a manner that it can no longer be attributed to an identified or identifiable natural person.
   2. “CCPA Personal Information” means the “personal information” (as defined in the CCPA) that RiskOptics Processes on behalf of the Customer and/or the Customer’s Affiliates in connection with RiskOptics’ provision of the Service.
   3. “Customer Data” will have the meaning set forth in the Agreement.
   4. “Data Protection Laws” means Regulation 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (“GDPR”); European Directive 2002/58/EC, as amended by Directive 2009/136/EC (“E-Privacy Directive”); the UK GDPR; and any United States laws or regulations protecting the fundamental rights and freedoms of persons and their right to privacy with regard to the processing of Personal Data including the California Consumer Privacy Act of 2018 and any binding regulations promulgated thereunder (“CCPA”), as amended including by the California Privacy Rights Act (“CPRA”); the Virginia Consumer Data Protection Act, Code of Virginia title 59.1, Chapter 52; the Colorado Privacy Act, Colorado Rev. Stat. 6-1-1301 et seq.; guidance issued by the U.S. Federal Trade Commission pursuant to its authority under Section 5 of the FTC Act, 15 U.S.C. § 45; in each case, as amended from time to time.
   5. “Data Subject” shall mean, as applicable, “data subject” as defined under the GDPR and UK GDPR, “consumer” under the CCPA and other Data Protection Laws, and any similar term under the Data Protection Laws.
   6. “GDPR Personal Data” means the “personal data” (as defined in the GDPR and UK GDPR) that RiskOptics Processes on behalf of the Customer and/or the Customer’s Affiliates in connection with RiskOptics’ provision of the Service.
   7. “Personal Data” means any information relating to a Data Subject which is subject to Data Protection Laws (defined below) and which RiskOptics Processes on behalf of Customer other than Anonymous Data. Personal Data includes GDPR Personal Data and CCPA Personal Information.
   8. “Personal Data Breach” means any confirmed breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored, or otherwise processed.
   9. “Service” will have the meaning set forth in the Agreement.
   10. “EU Standard Contractual Clauses” means the standard contractual clauses annex to European Commission Implementing Decision (EU) 2021/914 for the transfer of Personal Information to Third Countries (and any successor clauses), as currently set out at https://eurlex.europa.eu/eli/dec_impl/2021/914/oj.
   11. “Sub-Processor” means any third party appointed by or on behalf of RiskOptics to process Personal Data in connection with the Service.
   12. “Third Countries” means countries which are not recognized by the Data Protection Laws as countries providing adequate protection of Personal Information.
   13. “UK Data Protection Laws” means all laws relating to data protection, the processing of personal data, privacy and/or electronic communications in force from time to time in the UK, including the UK GDPR and the Data Protection Act 2018.
   14. “UK GDPR” means the United Kingdom General Data Protection Regulation, as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018.
   15. The terms “business,” “business purposes,” “consumer,” “controller,” “personal data breach,” “process” or “processing,” “processor,” “sale,” “sell,” “sensitive data,” “sensitive personal information,” “service provider,” “sharing,” “supervisory authority,” and “verifiable consumer request” will have the meanings given to those terms in the applicable Data Protection Laws to the extent such meanings are materially similar to the meaning of terms in effect on the Effective Date. In the event of a conflict in the meanings of terms among the Data Protection Laws, the parties agree that only the meanings in applicable Data Protection Laws will apply.

2. Processing of Personal Data

   1. Each party will comply with the obligations applicable to it under the Data Protection Laws, including with respect to the processing of Personal Data.
   2. RiskOptics will only process Personal Data in accordance with the instructions of Customer. Customer will ensure that its instructions comply with all laws, rules and regulations applicable in relation to the Personal Data, and that the processing of Personal Data in accordance with Customer’s instructions will not cause RiskOptics to be in breach of the Data Protection Laws. As between Customer and RiskOptics, Customer will be responsible for (i) the means by which Customer acquired Personal Data and (ii) the accuracy, quality, and legality of the Personal Data provided to RiskOptics by or on behalf of Customer.
   3. For the purposes of this DPA, the following is deemed an instruction by Customer to process Personal Data (a) to provide and support the Service; (b) as documented in the Agreement (including this DPA and any other agreement that requires processing of Personal Data); and (c) as further documented in any other specific written instructions given by Customer in this DPA, the Agreement, or as otherwise notified by Customer to RiskOptics from time to time), where such instructions are consistent with the terms of the Agreement.
   4. The subject-matter of the data processing covered by this DPA is the provision of the Service and support by RiskOptics. Schedule 1 of this DPA sets out the nature and purpose of the processing, the types of Personal Data RiskOptics processes and the categories of Data Subjects whose personal data is processed.
   5. For purposes of this DPA, Customer is the “controller” or “business,” and RiskOptics is the “processor” or “service provider” of Personal Data, as such terms are defined in the Data Protection Laws per Section 1 above.

3. Authorized Employees

   1. RiskOptics will only disclose Customer Data to employees who have a need to know or otherwise access Personal Data to enable RiskOptics to perform their obligations under this Addendum or the Agreement (“Authorized Employee”).
   2. RiskOptics will take commercially reasonable steps to ensure the reliability and appropriate training of any Authorized Employee.
   3. RiskOptics will ensure that all Authorized Employees are made aware of the confidential nature of Customer Data and have executed confidentiality agreements that prevent them from disclosing or otherwise processing, both during and after their engagement with RiskOptics, any Customer Data except in accordance with their obligations in connection with the Service.
   4. RiskOptics will take commercially reasonable steps to limit access to Customer Data to only Authorized Employees.

4. Authorized Sub-Processors

   1. Customer agrees that (a) RiskOptics may engage Affiliates and Sub-processors as listed at https://www.reciprocity.com/subprocessors/ (“Sub-Processor Page”) which may be updated from time to time and (b) such Affiliates and Sub-Processors respectively may engage third party Sub-Processors to process the Personal Data on RiskOptics’ behalf. By way of this Addendum, Customer provides general written authorization to RiskOptics to engage Sub-Processors as necessary to perform the Service.
   2. At least thirty (30) days before enabling any other Sub-Processors to access or participate in the processing of Personal Data, RiskOptics will add such third party to the Sub-Processor Page located at https://www.reciprocity.com/subprocessors/ (“Sub-Processor Page”). RiskOptics will provide written notification of a new Sub-Processor before authorizing any new Sub-Processor to process any Personal Data. Customer may reasonably object to such an engagement on legitimate grounds by informing RiskOptics in writing within ten (10) days of being informed of such new Sub-Processor.
   3. If Customer reasonably objects to an engagement in accordance with Section 4.2, and RiskOptics cannot provide a commercially reasonable alternative within a reasonable period of time, RiskOptics may terminate this Addendum as Customer’s sole and exclusive remedy for such objection. Termination will not relieve Customer of any fees owed to RiskOptics under the Agreement.
   4. If Customer does not object to the engagement of a third party in accordance with Section 4.2 within ten (10) days of notice by RiskOptics, that third party will be deemed an Authorized Sub-Processor for the purposes of this Addendum.
   5. RiskOptics will enter into a written agreement with the Authorized Sub-Processor imposing on the Authorized Sub-Processor data protection obligations comparable to those imposed on RiskOptics under this Addendum with respect to the protection of Personal Data. In case an Authorized Sub-Processors fails to fulfil its data protection obligations under such written agreement with RiskOptics, RiskOptics will remain liable to Customer for the performance of the Authorized Sub-Processor’s obligations under such agreement.

5. Security of PERSONAL Data

   1. Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of Processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, RiskOptics will maintain appropriate technical and organizational measures for protection of the security (including protection against unauthorized or unlawful Processing and against accidental or unlawful destruction, loss or alteration or damage, unauthorized disclosure of, or access to, PERSONAL Data), confidentiality and integrity of PERSONAL Data, as set forth in SCHEDULE 2.
   2. RiskOptics will notify Customer without undue delay after becoming aware of any Personal Data Breach. RiskOptics will make reasonable efforts to identify the cause of such Personal Data Breach and take such steps as RiskOptics deems necessary and reasonable to remediate the cause of such Personal Data Breach, to the extent the remediation is within RiskOptics’ reasonable control. RiskOptics will provide Customer with information and cooperation reasonably requested by Customer regarding such Personal Data Breach. RiskOptics’ notification of or response to a Personal Data Breach under this Section 5.1 will not be construed as an acknowledgment by RiskOptics of any fault or liability with respect to the Personal Data Breach. Unless required by law or by RiskOptics’ regulators, where Customer is the Data Controller, RiskOptics will not notify any Data Subject or any third party other than law enforcement of any Personal Data Breach involving Personal Data without first consulting with Customer. The obligations herein will not apply to incidents that are caused by Customer or Customer’s users.

6. REQUIREMENTS FOR GDPR PERSONAL DATA

   This Section 6 will only apply to the processing of GDPR Personal Data by or on behalf of RiskOptics.

   1. The parties agree that RiskOptics may transfer Personal Data processed under this Addendum outside the European Economic Area (“EEA”), UK, or Switzerland as necessary to provide the Service. If RiskOptics transfers Personal Data protected under this Addendum to a jurisdiction that has not been found to provide an adequate or equivalent level of protection under the applicable Data Protection Laws, RiskOptics will ensure that appropriate safeguards have been implemented for the transfer of Personal Data in accordance with Data Protection Laws.
   2. RiskOptics may engage Sub-Processors pursuant to Section 4 (Authorized Sub-Processors).
   3. Transfer Mechanisms. With regard to any transfers of GDPR Personal Data from the European Economic Area or the United Kingdom to countries that do not provide adequate protection for such data (as determined by the applicable Data Protection Laws), the parties hereby enter into applicable Standard Contractual Clauses in support of such transfer.
   4. For transfers of Personal Data from the United Kingdom, the International Data Transfer Addendum to the Model Clauses issued by the Information Commissioner’s Office of the United Kingdom (“UK Addendum”) (including all Part 2 Mandatory Clauses) is hereby incorporated by reference when they are available and are a valid transfer mechanism under applicable Data Protection Laws. The parties further agree to the following provisions with respect to the UK Addendum:
      1. Identity of the Parties: The data exporter is Customer, and the data importer is RiskOptics.
      2. Conflicts: In the event of any conflict or inconsistency between this Addendum and the UK Addendum, the UK Addendum will prevail.
      3. Appendices: Responses to the Appendices to the UK Addendum are provided in Schedule 1, attached hereto. The list of parties and the descriptions of the transfers are provided in Schedule 1. The technical and organizational measures including technical and organizational measures to ensure the security of the data are provided in Schedule 2.
      4. Ending this Addendum when the Approved Addendum Changes: The parties agree that Importer and Exporter may end the Addendum as set out in Section 19 of the UK Addendum.
      5. Specific Provisions:
         1. The Addendum EU SCCs will be the Approved EU SCCs.
         2. Module Two will apply.
         3. In Clause 7, the parties permit docking.
      6. The parties do not incorporate the optional liability clause included in the UK Addendum.
   5. For all other transfers of Personal Data under this DPA to Third Countries, to the extent such transfers are subject to such applicable Data Protection Laws, the EU Standard Contractual Clauses are hereby incorporated by reference when they are available and are a valid transfer mechanism under applicable Data Protection Laws. The parties further agree to the following provisions with respect to the EU Standard Contractual Clauses:
      1. Identity of the Parties: The data exporter is Customer, and the data importer is RiskOptics. Module Two (controller to processor) is the sole module applicable to transfers involving Personal Data.
      2. Conflicts: In the event of any conflict or inconsistency between this Addendum and the EU Standard Contractual Clauses, the EU Standard Contractual Clauses will prevail.
      3. Appendices: Responses to the Annexes to the EU Standard Contractual Clauses are provided in Schedule 1, attached hereto.
      4. Specific Provisions:
      5. In Clause 7, the parties permit docking.
      6. In Clause 9, the parties select Option 2 and a time period of 30 days.
      7. In Clause 11, the parties do not select the independent dispute resolution option.
   6. In Clauses 17 (Option 2) and 18(b), the parties agree that the jurisdiction is the member state in which Controller is established, or if the Controller is not established in a member state, the Republic of Ireland.
   7. Where applicable by virtue of Article 28(3)(f) of the GDPR or UK GDPR, RiskOptics will provide reasonable assistance to the Customer with any data protection impact assessments which are referred to in Article 35 of the GDPR and with any prior consultations to any Supervisory Authority of the Customer which are referred to in Article 36 of the GDPR, in each case solely in relation to processing of GDPR Personal Data and taking into account the nature of the processing and information available to RiskOptics.

7. REQUIREMENTS FOR CCPA

   Section 7 of this DPA will only apply to the processing of CCPA Personal Information by RiskOptics.

   1. RiskOptics will not retain, use, or disclose CCPA Personal Information for any purpose other than for the specific purpose of providing the Service, or as otherwise permitted by the CCPA. RiskOptics acknowledges and agrees that it will not retain, use, or disclose CCPA Personal Information for a purpose other than providing the Service, except as permitted by the CCPA. Processing CCPA Personal Information outside the scope of this DPA or the Agreement will require prior written agreement between the Customer and RiskOptics on additional instructions for processing.
   2. RiskOptics will not Sell or Share any CCPA Personal Information it collects pursuant to the Agreement with the Customer.
   3. RiskOptics will not retain, use, or disclose CCPA Personal Information collected pursuant to the DPA or Agreement for purposes outside the direct business relationship between RiskOptics and the Customer, unless expressly permitted by CCPA and its regulations. To the extent prohibited by the CCPA, RiskOptics will not combine CCPA Personal Information received from Customer with Personal Data that RiskOptics receives from, or on behalf of, another person or persons, or collects from its own interaction with consumers.

8. RIGHTS OF DATA SUBJECTS

   1. RiskOptics will, to the extent permitted by law, notify Customer upon receipt of a request by a Data Subject to exercise the Data Subject’s right of: access, rectification, erasure, data portability, restriction or cessation of processing, withdrawal of consent to processing, and/or objection to being subject to processing that constitutes automated decision-making (such requests individually and collectively “Data Subject Request(s)”). If RiskOptics receives a Data Subject Request in relation to Customer Data, RiskOptics will advise the Data Subject to submit their request to Customer and Customer will be responsible for responding to such request, including, where necessary, by using the functionality of the Service. Customer is solely responsible for ensuring that Data Subject Requests for erasure, restriction or cessation of processing, or withdrawal of consent to processing of any Personal Data are communicated to RiskOptics, and for ensuring that a record of consent to processing is maintained with respect to each Data Subject.
   2. RiskOptics will, at the request of the Customer, and taking into account the nature of the processing applicable to any Data Subject Request, apply appropriate technical and organizational measures to assist Customer in complying with Customer’s obligation to respond to such Data Subject Request and/or in demonstrating such compliance, where possible, provided that (i) Customer is itself unable to respond without RiskOptics’ assistance and (ii) RiskOptics is able to do so in accordance with all applicable laws, rules, and regulations. Customer will be responsible to the extent legally permitted for any costs and expenses arising from any such assistance by RiskOptics.

9. ACTIONS AND ACCESS REQUESTS

   1. RiskOptics will maintain records sufficient to demonstrate its compliance with its obligations under this Addendum, and retain such records for a period of two (2) years after the termination of the Agreement. Customer will, with reasonable notice to RiskOptics, have the right to review, audit and copy such records.
   2. Upon Customer’s request, RiskOptics will, no more than once per calendar year, either (i) make available for Customer’s review copies of certifications or reports demonstrating RiskOptics’ compliance with prevailing data security standards applicable to the processing of Customer Data, or (ii) if the provision of reports or certifications pursuant to (i) is not reasonably sufficient under Data Protection Laws, allow Customer or its authorized representative, upon reasonable notice and at a mutually agreeable date and time, to conduct an audit or inspection of RiskOptics’ data security infrastructure and procedures that is sufficient to demonstrate RiskOptics’ compliance with its obligations under this Addendum, provided that Customer will provide reasonable prior notice of any such request for an audit and such inspection will not be unreasonably disruptive to RiskOptics’ business. Customer will be responsible for the costs of any such audits or inspections, including, without limitation, a reimbursement to RiskOptics for any time expended for on-site audits. Any such audit will be subject to RiskOptics’ security and confidentiality terms and guidelines. If RiskOptics declines to follow any reasonable instruction requested by Customer regarding audits, Customer is entitled to terminate this DPA and the Agreement.
   3. RiskOptics will immediately notify Customer if an instruction, in RiskOptics’ opinion, infringes the Data Protection Laws or supervisory authority.
   4. Return or Deletion of Customer Data. Following termination or expiration of the Agreement, RiskOptics will return or delete the Customer Data, unless further storage of Customer Data is required or authorized by applicable law. If return or destruction is impracticable or prohibited by law, rule or regulation, RiskOptics will take measures to block such Customer Data from any further processing (except to the extent necessary for its continued hosting or processing required by law, rule, or regulation) and will continue to appropriately protect the Customer Data remaining in its possession, custody, or control.
10. Affiliates. The Customer acts as a single point of contact for its Affiliates with respect to compliance with Data Protection Laws such that where RiskOptics gives notice to the Customer, such information or notice is deemed received by the Customer’s Affiliates. The parties acknowledge and agree that any claims in connection with Data Protection Laws under this DPA will be brought by the Customer, whether acting for itself or on behalf of an Affiliate.
11. LIMITATION OF LIABILITY. THE TOTAL LIABILITY OF EACH OF CUSTOMER AND RECIPROCITY (AND THEIR RESPECTIVE EMPLOYEES, DIRECTORS, OFFICERS, AFFILIATES, SUCCESSORS, AND ASSIGNS), ARISING OUT OF OR RELATED TO THIS ADDENDUM, WHETHER IN CONTRACT, TORT, OR OTHER THEORY OF LIABILITY, WILL NOT, WHEN TAKEN TOGETHER IN THE AGGREGATE, EXCEED THE LIMITATION OF LIABILITY SET FORTH IN THE AGREEMENT.

SCHEDULE 1

Data Processing appendix

SCHEDULE 2

TECHNICAL AND ORGANISATIONAL MEASURES INCLUDING TECHNICAL AND ORGANISATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA

Description of the technical and organisational measures implemented by the data importer(s) (including any relevant certifications) to ensure an appropriate level of security, taking into account the nature, scope, context and purpose of the processing, and the risks for the rights and freedoms of natural persons.

SCHEDULE 3

LIST OF SUB-PROCESSORS

RiskOptics’ list of sub-processors (including Affiliates) is available at https://www.reciprocity.com/subprocessors/. The Sub-Processor Page may be updated from time to time in accordance with this DPA.