Cybba

The term of this DPA shall follow the term of the Agreement Terms not otherwise defined herein shall have the meaning as set forth in the Agreement

• (i) Standard Contractual Clauses, attached hereto as EXHIBIT 1
• (a) Appendix 1 to the Standard Contractual Clauses, which includes specifics on the Personal Data transferred by the data exporter to the data importer
• (b) Appendix 2 to the Standard Contractual Clauses, which includes a description of the technical and organizational security measures implemented by the data importer as referenced
• (ii) List of Sub-Processors, attached hereto as EXHIBIT 2

“Controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the Processing of Personal Data

“Data Protection Laws and Regulations” means all applicable legislation relating to data protection and privacy including without limitation the EU Data Protection Directive 95/46/EC and all local laws and regulations which amend or replace any of them, including the GDPR, together with any national implementing laws in any Member State of the European Union, the United States and its states, including the CCPA or, to the extent applicable, in any other country, as amended, repealed, consolidated or replaced from time to time The terms “process”, “processes” and “processed” will be construed accordingly

“Data Subject” means the individual to whom Personal Data relates

“GDPR” means the General Data Protection Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data

“CCPA” means the California Consumer Privacy Act, Cal Civ Code § 1798 100 et seq , and its implementing regulations

“Instruction” means the written, documented instruction, issued by Controller to Processor, and directing the same to perform a specific action with regard to Personal Data (including, but not limited to, depersonalizing, blocking, deletion, making available)

“Personal Data” means any information relating to an identified or identifiable individual where such information is contained within Customer Data and is protected similarly as personal data or personally identifiable information under applicable Data Protection Law “Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored or otherwise processed

“Processing” means any operation or set of operations which is performed on Personal Data, encompassing the collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction or erasure of Personal Data

“Processor” means a natural or legal person, public authority, agency or other body which processes Personal Data on behalf of the Controller

“Standard Contractual Clauses” means the clauses attached hereto as Exhibit 1 pursuant to the European Commission’s decision (C(2010)593) of 5 February 2010 on Standard Contractual Clauses for the transfer of personal data to processors established in third countries which do not ensure an adequate level of data protection

2. Details of the Processing

a Categories of Data Subjects Controller’s Contacts and other end users which may include, but is not limited to the following categories of Data Subjects:

• Prospects, customers, business partners and vendors of Controller
• Employees or contact persons of Controller’s prospects, customers, business partners and vendors
• Employees, agents and advisors of Controller
• Controller’s Users authorized by Controller to use the Services, such as website visitors b Types of Personal Data Personal Data, the extent of which is determined and controlled by the Controller in its sole discretion, and which may include but is not limited to the following categories of Personal Data:
• First and last name
• Email, phone, physical business address c Subject Matter and Nature of the Processing The subject matter of Processing of Personal Data by Processor is the provision of the services to the Controller that involves the Processing of Personal Data Personal Data will be subject to those Processing activities as may be specified in the Agreement and an IO

d Purpose of the Processing Personal Data will be Processed for purposes of providing the services set out and otherwise agreed to in the Agreement and any applicable IO

e Duration of the Processing Personal Data will be Processed for the duration of the Agreement, subject to Section 4 of this DPA

Within the scope of the Agreement and in its use of the services, Controller shall be solely responsible for complying with the statutory requirements relating to data protection and privacy, in particular regarding the disclosure and transfer of Personal Data to the Processor and the Processing of Personal Data For the avoidance of doubt, Controller’s instructions for the Processing of Personal Data shall comply with the Data Protection Law This DPA is Customer’s complete and final instruction to Cybba in relation to Personal Data and that additional instructions outside the scope of DPA would require prior written agreement between the parties Instructions shall initially be specified in the Agreement and may, from time to time thereafter, be amended, amplified or replaced by Controller in separate written instructions (as individual instructions)