Data Processing Agreement

BACKGROUND

(A)The Customer and the Provider entered into the Contract in and around the date hereof that may require the Provider to process Personal Data on behalf of the Customer.

(B)This Personal Data Processing Agreement (“Agreement”) sets out the additional terms, requirements and conditions on which the Provider will process Personal Data when providing services under the Contract. This Agreement contains the mandatory clauses required by Article 28(3) of the retained EU law version of the General Data Protection Regulation ((EU) 2016/679) (UK GDPR) for contracts between controllers and processors and the General Data Protection Regulation ((EU) 2016/679).

AGREED TERMS

1.Definitions and interpretation

The following definitions and rules of interpretation apply in this Agreement.

1.1Definitions:

Business Purposes: the services to be provided by the Provider to the Customer as described in the Contract and any other purpose specifically identified in ANNEX A.

Commissioner: the Information Commissioner (see Article 4(A3), UK GDPR and section 114, DPA 2018).

Controller: has the meaning given in section 6, DPA 2018.

Data Protection Legislation:

a)To the extent the UK GDPR applies, the law of the United Kingdom or of a part of the United Kingdom which relates to the protection of Personal Data, including the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (SI 2003/2426) (as amended).

b)To the extent the EU GDPR applies, the law of the European Union or any member state of the European Union to which the Customer or Provider is subject, which relates to the protection of Personal Data.

Data Subject: the identified or identifiable living individual to whom the Personal Data relates.

EEA: the European Economic Area.

EU GDPR: the General Data Protection Regulation ((EU) 2016/679).

Personal Data: means any information relating to an identified or identifiable living individual that is processed by the Provider on behalf of the Customer as a result of, or in connection with, the provision of the services under the Contract; an identifiable living individual is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.

Processing, processes, processed, process: any activity that involves the use of the Personal Data. It includes, but is not limited to, any operation or set of operations which is performed on the Personal Data or on sets of the Personal Data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction. Processing also includes transferring the Personal Data to third parties.

Personal Data Breach: a breach of security leading to the accidental, unauthorised or unlawful destruction, loss, alteration, disclosure of, or access to, the Personal Data.

Processor: a natural or legal person, public authority, agency or other body which processes personal data on behalf of the Controller.

Standard Contractual Clauses (SCCs): the ICO's International Data Transfer Agreement for the transfer of personal data from the UK and/or the ICO's International Data Transfer Addendum to EU Commission Standard Contractual Clauses and/or the European Commission's Standard Contractual Clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 as set out in the Annex to Commission Implementing Decision (EU) 2021/914.

UK GDPR: has the meaning given in section 3(10) (as supplemented by section 205(4)) of the DPA 2018.

1.2This Agreement is subject to the terms of the Contract and is incorporated into the Contract. Interpretations and defined terms set forth in the Contract apply to the interpretation of this Agreement.

1.3The Annex forms part of this Agreement and will have effect as if set out in full in the body of this Agreement. Any reference to this Agreement includes the Annex.

1.4A reference to writing or written excludes fax but not email.

2.Personal data types and processing purposes

2.1The Customer and the Provider agree and acknowledge that for the purpose of the Data Protection Legislation:

(a)the Customer is the controller and the Provider is the processor.

(b)the Customer retains control of the Personal Data and remains responsible for its compliance obligations under the applicable Data Protection Legislation, including but not limited to providing any required notices and obtaining any required consents, and for the written processing instructions it gives to the Provider.

(c)ANNEX A describes the subject matter, duration, nature and purpose of the processing and the Personal Data categories and Data Subject types in respect of which the Provider may process the Personal Data to fulfil the Business Purposes.

3.Provider's obligations

3.1The Provider will only process the Personal Data to the extent, and in such a manner, as is necessary for the Business Purposes. The Provider will not process the Personal Data for any other purpose or in a way that does not comply with this Agreement or the Data Protection Legislation.

3.2The Provider will maintain the confidentiality of the Personal Data and will not disclose the Personal Data to third parties unless the Customer or this Agreement specifically authorises the disclosure, or as required by domestic law, court or regulator (including the Commissioner). If a domestic law, court or regulator (including the Commissioner) requires the Provider to process or disclose the Personal Data to a third party, the Provider must first inform the Customer of such legal or regulatory requirement and give the Customer an opportunity to object or challenge the requirement, unless the domestic law prohibits the giving of such notice.

3.3The Provider will, taking into account the nature of its Processing and the information available to it, reasonably assist the Customer, in meeting the Customer's obligations under the Data Protection Legislation, including obligations relating to:

(a)Data Subject rights, including subject access requests, requests for further information from Data Subjects where required to enable the Customer to respond, and reasonable and proportionate searches for Personal Data.

(b)Complaints made by Data Subjects or other individuals concerning Processing of Personal Data or compliance with the Data Protection Legislation.

(c)Data protection impact assessments and prior consultation with the Commissioner or any other competent supervisory authority.

(d)Personal Data Breaches and security incidents.

(e)Records of processing, accountability and audit requirements.

(f)Safeguards applicable to solely automated decision-making, including any requirement to provide information, enable representations, enable challenge or obtain human intervention, where the Provider performs Processing relevant to such decision-making.

3.4Where any such assistance referred to in 3.3 requires material expenditure of time, resources or costs beyond the ordinary provision of the Services, the Provider may charge the Customer its reasonable then-current professional service rates.

4.Provider's Personnel

4.1The Provider shall take reasonable steps to ensure that all of its personnel:

(a)are informed of the confidential nature of the Personal Data and are bound by confidentiality obligations and use restrictions in respect of the Personal Data; and

(b)are aware both of the Provider's duties and their personal duties and obligations under the Data Protection Legislation and this Agreement.

5.Security

5.1The Provider shall implement appropriate technical and organisational measures against unauthorised or unlawful processing, access, copying, modification, reproduction, display or distribution of the Personal Data, and against accidental or unlawful loss, destruction, alteration, disclosure or damage of Personal Data.

5.2The Provider may update or modify its technical and organisational measures from time to time, provided that such updates do not materially diminish the overall level of security of the Services.

6.Personal Data Breach

6.1The Provider shall without undue delay notify the Customer if it becomes aware of:

(a)the loss, unintended destruction or damage, corruption, or unusability of part or all of the Personal Data;

(b)any accidental, unauthorised or unlawful processing of the Personal Data; or

(c)any Personal Data Breach.

6.2Where the Provider becomes aware of (a), (b) and/or (c) above, it shall, without undue delay, also provide the Customer with the following information:

(a)description of the nature of (a), (b) and/or (c), including the categories of in-scope Personal Data and approximate number of both Data Subjects and the Personal Data records concerned;

(b)the likely consequences; and

(c)a description of the measures taken or proposed to be taken to address (a), (b) and/or (c), including measures to mitigate its possible adverse effects.

6.3The Provider shall co-operate with the Customer and take reasonable commercial steps as directed by the Customer to assist in the investigation, mitigation and remediation of such Personal Data Breach.

7.Transfers of personal data

7.1The Customer authorises the Provider to transfer Personal Data outside the UK and/or EEA where necessary for the provision of the Services, including to the sub-processors identified in Annex A, provided that the Provider implements appropriate safeguards in accordance with applicable Data Protection Legislation, including adequacy regulations, Standard Contractual Clauses and/or the UK International Data Transfer Addendum, where required.

8.Subcontractors

8.1The Provider may not authorise any third party or subcontractor to process the Personal Data other than those subcontractors as set out in Annex A.

8.2Those subcontractors approved as at the commencement of this Agreement are as set out in ANNEX A.

8.3The Provider may appoint additional sub-processors provided that it gives the Customer at least thirty (30) days' prior notice of the proposed appointment and maintains an up-to-date list of authorised sub-processors. The Customer may object to the appointment of a proposed sub-processor on reasonable data protection grounds by written notice to the Provider within such notice period. The parties shall work in good faith to resolve any such objection. If the parties are unable to resolve the objection within a reasonable period, the Customer may terminate the affected Services on written notice.

9.Term and termination

9.1This Agreement will remain in full force and effect so long as:

(a)the Contract remains in effect; or

(b)the Provider retains any of the Personal Data related to the Contract in its possession or control (Term).

9.2Any provision of this Agreement that expressly or by implication should come into or continue in force on or after termination of the Contract in order to protect the Personal Data will remain in full force and effect.

10.Data return and destruction

10.1The Provider shall, within thirty (30) days following expiry of the export period referred to in Clause 14.5 of the Contract (the "Cessation Date"), delete and procure the deletion of all copies of those Personal Data, subject to any legal or regulatory retention obligations, any requirement to retain Personal Data for the establishment, exercise or defence of legal claims and any backup retention procedures described in Annex A.

10.2The Provider shall provide written certification to Customer that it has fully complied with this section within thirty (30) days of the Cessation Date.

11.Audit rights

11.1Subject to this clause 11, the Provider shall make available to the Customer, upon reasonable written request, such information as is reasonably necessary to demonstrate compliance with this Agreement and shall allow for and contribute to audits, including inspections, by the Customer or an independent auditor mandated by the Customer, in relation to the Processing of Customer Personal Data, provided that such audits are conducted on reasonable notice, during normal business hours and in a manner that minimises disruption to the Provider's business.

11.2Information and audit rights of the Customer only arise under clause 11.1 to the extent that the Agreement does not otherwise give them information and audit rights meeting the relevant requirements of Data Protection Legislation.

12.Warranties

12.1The Provider warrants and represents that:

(a)it has no reason to believe that the Data Protection Legislation prevents it from providing any of the Contract's contracted services; and

(b)considering the current technology environment and implementation costs, it will take appropriate technical and organisational measures to prevent the unauthorised or unlawful processing of Personal Data and the accidental loss or destruction of, or damage to, Personal Data.

12.2The Customer warrants and represents that the Provider's expected use of the Personal Data for the Business Purposes and as specifically instructed by the Customer will comply with the Data Protection Legislation.

13.Liability and Indemnification

13.1The Provider will not be liable for the actions or omissions of the Customer.

13.2The liability of the parties under this Agreement shall be subject to the exclusions and limitations of liability contained in the Contract.

14.Notices.

14.1Any notice given to a party under or in connection with this Agreement shall be in writing and shall be:

(i)delivered by hand or by pre-paid first-class post or other next working day delivery service to its registered office (if a company) or its principal place of business (in any other case); or

(ii)sent by email to the address specified in the order form (or to any substitute address as it may have notified to the other party in accordance with this clause)

14.2Any notice will be deemed to have been received:

(i)if delivered by hand, at the time the notice is left at the proper address;

(ii)if sent by pre-paid first-class post or other next working day delivery service, at 9.00 am on the second Business Day after posting; or

(iii)if sent by email, at the time of transmission or, if this time falls outside business hours, when business hours resume. In this clause, business hours means 9.00am to 5.00pm Monday to Friday on a day that is not a public holiday in the place of receipt.

14.3This clause 14 does not apply to the service of any proceedings or other documents in any legal action or, where applicable, any arbitration or other method of dispute resolution.

ANNEX APersonal Data processing purposes and details

1.Details of Data Processing:

2.list of AUTHORISED sub-processors:

The Provider maintains an up-to-date list of authorised sub-processors at https://www.quorums.ai/subprocessors. The Provider may update the list from time to time in accordance with clause 8.3 and Annex A shall be deemed updated accordingly.