Data Processing Addendum

This Data Protection Addendum ("Addendum") supplements the Agreement between Customer and Attributy into which it is incorporated by reference ("Agreement").

Any capitalized term used but not defined in this Addendum has the meaning provided to it in the Agreement.

• "Applicable Data Protection Law" refers to all laws and regulations applicable to Attributy's processing of personal data under the Agreement.
• "controller" means the natural or legal person, public authority, agency, or other body that, alone or jointly with others, determines the purposes and means of processing personal data.
• "Customer Account Data" means personal data that relates to Customer's relationship with Attributy, including the names or contact information of individuals authorized by Customer to access Customer's account and billing information of individuals associated with its account. It also includes data required for identity verification, including MFA Services or Subscriber Records.
• "Customer Content" means personal data exchanged due to using the Services, such as text, message bodies, voice/video media, images, emails, and recipients.
• "Customer Data" has the meaning given in the Agreement and includes Customer Account Data, Customer Usage Data, Customer Content, and Sensitive Data.
• "Customer Usage Data" means data processed by Attributy to transmit or exchange Customer Data, including data identifying source/destination of communications and activity logs used for optimization, maintenance, and fraud prevention.
• "Multi-Factor Authentication Services (MFA Services)" refers to a portion of Attributy Services where Customer adds an identity verification factor for end users.
• "personal data" means any information relating to an identified or identifiable natural person ("data subject").
• "Privacy Policy" means the then-current privacy policy for the Services available at https://www.attributy.com/security-overview.
• "processor" means the entity that processes personal data on behalf of the controller.
• "processing" (and "process") means any operation on personal data by automated or manual means, such as collection, storage, use, disclosure, or destruction.
• "Security Incident" means confirmed or reasonably suspected accidental or unlawful destruction, loss, alteration, or unauthorized access/disclosure of Customer Data.
• "Services" means, collectively, the Attributy Services.
• "Standard Contractual Clauses" has the meaning outlined in Schedule 3 of this Addendum.
• "Subscriber Records" means Customer Account Data necessary for providing phone numbers in certain countries, shared with providers or authorities as required.
• "sub-processor" means a third-party processor engaged by Attributy to process Customer Data on behalf of Customer.
• "Third Party Request" means any request, inquiry, or complaint from a data subject, authority, or third party.
• "Attributy Services" means the products/services under a Customer account, including platform APIs and communication services.

2.1 Attributy as a Processor. The parties acknowledge and agree that concerning the processing of Customer Content, the Customer may act either as a controller or processor, and Attributy is a processor. Attributy will process Customer Content in accordance with Customer's instructions as outlined in Section 5 (Customer Instructions).

2.2 Attributy as a Controller of Customer Account Data. The parties acknowledge that, concerning the processing of Customer Account Data, the Customer is a controller, and Attributy is an independent controller, not a joint controller with the Customer. Attributy will process Customer Account Data as a controller (a) in order to manage the relationship with Customer; (b) carry out Attributy's core business operations, such as accounting and filing taxes; (c) in order to detect, prevent, or investigate security incidents, fraud, and other abuse or misuse of the Services; (d) identity verification; (e) to comply with Attributy's legal or regulatory obligation to retain Subscriber Data; and (f) as otherwise permitted under Applicable Data Protection Law and in accordance with this Addendum, the Agreement, and the Privacy Policy.

2.3 Attributy as a Controller of Customer Usage Data. The parties acknowledge that, with regard to the processing of Customer Usage Data, the Customer may act either as a controller or processor, and Attributy is an independent controller, not a joint controller with Customer. Attributy will process Customer Usage Data as a controller in order to carry out the necessary functions as a communications service provider, such as: (a) Attributy's accounting, tax, billing, audit, and compliance purposes; (b) to provide, optimize, and maintain the Services and platform and security; (c) to investigate fraud, spam, wrongful or unlawful use of the Services; (d) as required by applicable law or regulation; or (e) as otherwise permitted under Applicable Data Protection Law and in accordance with this Addendum, the Agreement, and the Privacy Policy.

3. Purpose Limitation. Attributy will process personal data in order to provide the Services in accordance with the Agreement. Schedule 1 (Details of Processing) of this Addendum further specifies the nature and purpose of the processing, the processing activities, the duration of the processing, the types of personal data and categories of data subjects.

4. Compliance. Customer is responsible for ensuring that (a) it has complied, and will continue to comply, with Applicable Data Protection Law in its use of the Services and its own processing of personal data and (b) it has, and will continue to have, the right to transfer, or provide access to, personal data to Attributy for processing in accordance with the terms of the Agreement and this Addendum.

5. Customer Instructions. Customer appoints Attributy as a processor to process Customer Content on behalf of, and in accordance with, Customer's instructions (a) as set forth in the Agreement, this Addendum, and as otherwise necessary to provide the Services to Customer (which may include investigating security incidents and preventing spam or fraudulent activity, and detecting and preventing network exploits or abuse); (b) as necessary to comply with applicable law or regulation, including Applicable Data Protection Law; and (c) as otherwise agreed in writing between the parties ("Permitted Purposes").

5.1 Lawfulness of the Customer's Instructions. Customer will ensure that its instructions comply with Applicable Data Protection Law. Customer acknowledges that Attributy is neither responsible for determining which laws or regulations apply to Customer's business nor whether Attributy's provision of the Services meets those requirements. Customer will ensure that Attributy's processing of Customer Content, when done in accordance with Customer's instructions, will not cause Attributy to violate any applicable law. Attributy will inform Customer if it reasonably believes that Customer's instructions violate any applicable law.

5.2 Additional Instructions. Additional instructions outside the scope of the Agreement or this Addendum will be agreed upon by the parties in writing, including any additional fees payable by Customer.

6. Confidentiality

6.1 Responding to Third Party Requests. If any Third Party Request is made directly to Attributy, Attributy will promptly inform Customer unless prohibited by law. Attributy will not respond without Customer’s prior consent, unless legally required.

6.2 Confidentiality Obligations of Attributy Personnel. Attributy ensures all personnel authorized to process Customer Content are bound by confidentiality obligations.

7. Sub-processors

7.1 Authorization. Customer provides general authorization for Attributy to use sub-processors, under these conditions:

• Only necessary access to Customer Content.
• Sub-processors must contractually safeguard Customer Content as per Applicable Data Protection Law.
• Attributy remains liable for breaches caused by its sub-processors.

7.2 Objection Right. Customer may object to any new sub-processor on reasonable data protection grounds. If no resolution is reached within 90 days, Customer may stop using the affected services, subject to prior fees.

8. Data Subject Rights

8.1 Attributy Services. Attributy provides tools to assist Customer in fulfilling data subject rights requests. Additional support is available for complex requests (at Customer’s expense if resources are significant). Attributy will also assist with data protection impact assessments and regulatory consultations as required.

10. Return or Deletion of Customer Data

Attributy will delete or return Customer Content as described in Schedule 1. Upon termination, Customer Content is either returned or deleted, unless retention is legally required.

10.1 Extension of Addendum. Attributy may retain Customer Content temporarily post-termination if necessary for Permitted Purposes, and it remains protected by the Agreement and Applicable Data Protection Law.

10.2 Retention Required by Law. Attributy may retain Customer Content if legally required, ensuring ongoing protection under the Addendum terms.

11.1 Security Measures. Attributy has implemented and will maintain the technical and organizational security measures as set forth in the Agreement. Additional information is provided in Schedule 2 (Technical and Organizational Security Measures).

11.2 Determination of Security Requirements. Customer acknowledges the Services include certain features and functionalities that Customer may elect to use which impact the security of Customer Data processed by Customer's use of the Services, such as, but not limited to, encryption of voice recordings, availability of multi-factor authentication on Customer's account, or optional TLS encryption. Customer is responsible for reviewing the information Attributy makes available regarding its data security, including its audit reports, and making an independent determination as to whether the Services meet the Customer's requirements and legal obligations, including its obligations under Applicable Data Protection Law. Customer is further responsible for properly configuring the Services and using features and functionalities made available by Attributy to maintain appropriate security in light of the nature of Customer Data processed as a result of Customer's use of the Services.

11.3 Security Incident Notification. Attributy will provide notification of a Security Incident in the following manner:

• (a) Attributy will, to the extent permitted by applicable law, notify Customer without undue delay, but in no event later than seventy-two (72) hours after Attributy's discovery of a Security Incident impacting Customer Data of which Attributy is a processor;.
• (b) Attributy will, to the extent permitted and required by applicable law, notify Customer without undue delay of any Security Incident involving Customer Data of which Attributy is a controller; and
• (c) Attributy will notify Customer of any Security Incident via email to the email address(es) designated by Customer in Customer's account.

Attributy will make reasonable efforts to identify a Security Incident, and to the extent a Security Incident is caused by Attributy's violation of this Addendum, remediate the cause of such Security Incident. Attributy will provide reasonable assistance to Customer in the event that Customer is required under Applicable Data Protection Law to notify a regulatory authority, or any data subjects impacted by a Security Incident.

12. Audits. The parties acknowledge that Customer must be able to assess Attributy's compliance with its obligations under Applicable Data Protection Law and this Addendum, insofar as Attributy is acting as a processor on behalf of Customer.

12.1 Attributy's Audit Program. Attributy uses external auditors to verify the adequacy of its security measures with respect to its processing of Customer Content. Such audits are performed at least once annually at Attributy's expense by independent third-party security professionals at Attributy's selection and result in the generation of a confidential audit report ("Audit Report"). A description of Attributy's certifications and standards for audit of the Attributy Services can be found at https://Attributy.com/security-overview.

12.2 Customer Audit. Upon Customer's request at reasonable intervals and subject to reasonable confidentiality controls, Attributy will make a copy of Attributy's most recent Audit Report available to Customer. Customer agrees that any audit rights granted by Applicable Data Protection Law will be satisfied by these Audit Reports. To the extent that Attributy's provision of an Audit Report does not provide sufficient information or Customer is required to respond to a regulatory authority audit, Customer agrees to a mutually agreed-upon audit plan with Attributy that:

• (a) ensures the use of an independent third party;
• (b) provides notice to Attributy in a timely fashion;
• (c) requests access only during business hours;
• (d) accepts billing to Customer at Attributy's then-current rates;
• (e) occurs no more than once annually;
• (f) restricts its findings to only data relevant to Customer; and
• (g) obligates Customer, to the extent permitted by law or regulation, to keep confidential any information gathered that, by its nature, should be confidential.

V. International customer Processing in the United States.Customer acknowledges that Attributy's primary processing facilities are in the United States of America as of the Effective Date.

14. Jurisdiction Specific Terms.To the extent Attributy processes personal data originating from and protected by Applicable Data Protection Law in one of the jurisdictions listed in Schedule 4 (Jurisdiction Specific Terms) of this Addendum, the terms specified in Schedule 4 with respect to the applicable jurisdiction(s) apply in addition to the terms of this Addendum.

15. Cross Border Data Transfer Mechanisms for Data Transfers.To the extent Customer's use of the Services requires an onward transfer mechanism to lawfully transfer personal data from a jurisdiction (i.e., the European Economic Area ("EEA "), the United Kingdom, Switzerland, or any other jurisdiction listed in Schedule 4 (Jurisdiction Specific Terms)) to Attributy located outside of that jurisdiction ("Transfer Mechanism"), the terms set forth in Schedule 3 (Cross Border Transfer Mechanisms) will apply.

16. Cooperation and Data Subject Rights. In the event that either party receives:

• (a) any request from a data subject to exercise any of its rights under Applicable Data Protection Law (including rights of access, correction, objection, erasure, and data portability, as applicable); or
• (b) any Third Party Request relating to the processing of Customer Account Data or Customer Usage Data conducted by the other party,

such party will promptly inform the other party in writing. The parties agree to cooperate, in good faith, as necessary to respond to any Third Party Request and fulfill their respective obligations under Applicable Data Protection Law.

17. Conflict. In the event of any conflict or inconsistency among the following documents, the order of precedence will be:

• (1) the applicable terms in Schedule 4 (Jurisdiction Specific Terms);
• (2) the terms of this Addendum outside of Schedule 4;
• (3) the Agreement; and
• (4) the Privacy Policy.

Any claims brought in connection with this Addendum will be subject to the terms and conditions, including, but not limited to, the exclusions and limitations set forth in the Agreement.

18. Failure to Perform. In the event that changes in law or regulation render the performance of this Addendum impossible or commercially unreasonable, the parties may renegotiate this Addendum in good faith. If renegotiation would not cure the impossibility or the parties cannot reach an agreement, the parties may mutually agree to terminate the Agreement for convenience.

19. Amendments. Section 12.9 of the Agreement is hereby incorporated by reference in its entirety mutatis mutandis.

1. Nature and Purpose of the Processing. Attributy will process personal data as necessary to provide the Services under the Agreement. Attributy does not sell Customer's personal data or Customer end users' personal data and does not share such end users' information with third parties for compensation or for those third parties' own business interests.

1.1 Customer Content. Attributy will process Customer Content as a processor in accordance with Customer's instructions as set forth in Section 5 (Customer Instructions) of this Addendum.

1.2 Customer Account Data. Attributy will process Customer Account Data as a controller for the purposes outlined in Section 2.2 (Attributy as a Controller of Customer Account Data) of this Addendum.

1.3 Customer Usage Data. Attributy will process Customer Usage Data as a controller for the purposes outlined in Section 2.3 (Attributy as a Controller of Customer Usage Data) of this Addendum.

2. Processing Activities.

2.1 Customer Content. Personal data contained in Customer Content will be subject to the following basic processing activities:

For the Attributy Services, the provision of programmable communication products and services, primarily offered in the form of application programming interfaces (APIs), to Customer, including transmittal to or from Customer's software application from or to the publicly-switched telephone network (PSTN) or by way of other communications networks. Storage of personal data is on Attributy's network.

2.2 Customer Account Data. Personal data contained in Customer Account Data will be subject to the processing activities of providing the Services.

2.3 Customer Usage Data. Personal data contained in Customer Usage Data will be subject to the processing activities of providing the Attributy Services.

3. Duration of the Processing. The period for which personal data will be retained and the criteria used to determine that period is as follows:

3.1 Customer Data. Prior to the termination of the Agreement, Attributy will process stored Customer Content for the Permitted Purposes until Customer elects to delete such Customer Content via the Attributy Services. Prior to the termination of the Agreement, Customer agrees that it is solely responsible for deleting Customer Content via the Attributy Services.

• Upon termination of the Agreement, Attributy will:
  • (i) provide Customer thirty (30) days after the termination effective date to obtain a copy of any stored Customer Content via the Attributy Services;
  • (ii) automatically delete any stored Customer Content thirty (30) days after the termination effective date;
  • (iii) automatically backup any stored Customer Content on Attributy's backup systems sixty (60) days after the termination effective date.
• Backup Customer Content archived on Attributy's backup systems will be securely isolated and protected from any further processing, except as otherwise required by applicable law or regulation.

3.2 Customer Account Data. Attributy will process Customer Account Data as long as required:

• (a) to provide the Services to Customer;
• (b) for Attributy's legitimate business needs; or
• (c) by applicable law or regulation.

Customer Account Data will be stored in accordance with the Privacy Policy.

3.3 Customer Usage Data. Upon termination of the Agreement, Attributy may retain, use, and disclose Customer Usage Data for the purposes outlined in Section 1.3 (Customer Usage Data) of this Schedule 1, subject to the confidentiality obligations outlined in the Agreement. Attributy will anonymize or delete Customer Usage Data when Attributy no longer requires it for the purposes outlined in Section 1.3.

4. Categories of Data Subjects.

• 4.1 Customer Data: Customer's end users.
• 4.2 Customer Account Data: Customer's employees and individuals authorized by Customer to access Customer's Attributy account or make use of the MFA Services received from Attributy.
• 4.3 Customer Usage Data: Customer's end users.

5. Categories of Personal Data. Attributy processes personal data contained in Customer Account Data, Customer Content, and Customer Usage Data.

6. Sensitive Data or Special Categories of Data.

6.1 Customer Content. Sensitive Data may, from time to time, be processed via the Services where Customer or its end users choose to include Sensitive Data within the communications transmitted using the Services. Customer is responsible for ensuring that suitable safeguards are in place prior to transferring or processing, or permitting end-users to transmit or process, any Sensitive Data via the Services.

6.2 Customer Account Data and Customer Usage Data.

• (a) Sensitive Data may be found in Customer Account Data in the form of Subscriber Data containing passport or similar identifier data necessarily processed in order to receive telephone number assignments.
• (b) Sensitive Data is not contained in Customer Usage Data.

The full text of Attributy's technical and organizational security measures to protect Customer Data is available at https://attributy.com/security-overview ("Security Overview").

Where applicable, this Schedule 2 will serve as Annex II to the Standard Contractual Clauses. The following table provides more information regarding the technical and organizational security measures set forth below:

1. Definitions

"EC" means the European Commission

"EEA" means the European Economic Area

"Standard Contractual Clauses" means, depending on the circumstances unique to the Customer:

• UK Standard Contractual Clauses
• 2021 Standard Contractual Clauses

"UK Standard Contractual Clauses" means:

• Standard Contractual Clauses for the data controller to data processor transfers approved by the European Commission in decision 2010/87/EU ("UK Controller to Processor SCCs"), and
• Standard Contractual Clauses for the data controller to data controller transfers approved by the European Commission in decision 2004/915/EC ("UK Controller to Controller SCCs ").

"2021 Standard Contractual Clauses" means the Standard Contractual Clauses approved by the European Commission in decision 2021/914.

"Attributy BCRs" means Attributy's Binding Corporate Rules.

2. Cross Border Data Transfer Mechanisms

2.1 Order of Precedence. In the event the Services are covered by more than one Transfer Mechanism, the transfer of personal data will be subject to a single Transfer Mechanism in accordance with the following order of precedence: (a) Attributy's binding corporate rules as set forth in Section 2.2 (Attributy BCRs - Attributy Services) of this Schedule 3; (b) the applicable Standard Contractual Clauses as set forth in Section 2.3 (UK Standard Contractual Clauses) or Section 2.4 (The 2021 Standard Contractual Clauses) of this Schedule 3; and (c) other applicable data Transfer Mechanisms permitted under Applicable Data Protection Law.

2.2 Attributy BCRs - Attributy Services. The parties agree that Attributy will process personal data within the Attributy Services in accordance with the Attributy BCRs. The parties further agree that with respect to the Attributy Services, the Attributy BCRs will be the lawful Transfer Mechanism of Customer Account Data, Customer Content, and Customer Usage Data from the EEA, Switzerland, or the United Kingdom to (a) Attributy in the United States of America or (b) any other non-EEA Attributy entity.

2.3 UK Standard Contractual Clauses. The parties agree that the UK Standard Contractual Clauses will apply to personal data that is transferred via the Services from the United Kingdom, either directly or via onward transfer, any country or recipient outside of the United Kingdom that is: (a) not recognized by the competent United Kingdom regulatory authority or governmental body for the United Kingdom as providing an adequate level of protection for personal data and (b) not covered by the Attributy BCRs. For data transfers from the United Kingdom that are subject to the UK Standard Contractual Clauses, the UK Standard Contractual Clauses will be deemed entered into (and incorporated into this Addendum by this reference) and completed as follows:

(a) The UK Controller to Processor SCCs will apply where Attributy is processing Customer Content. The illustrative indemnification clause will not apply. Schedule 1 (Details of Processing) of this Addendum serves as Appendix I of the UK Controller to Processor SCCs. Schedule 2 (Technical and Organizational Security Measures) of this Addendum serves as Appendix II of the UK Controller to Processor SCCs.

(b) The UK Controller to Controller SCCs will apply where Attributy is processing Customer Account Data or Customer Usage Data. In Clause II(h) of the UK Controller to Controller SCCs, Attributy will process personal data in accordance with the data processing principles set forth in Annex A of the UK Controller to Controller SCCs. The illustrative commercial clause will not apply. Schedule 1 (Details of Processing) of this Addendum serves as Annex B of the UK Controller to Controller SCCs. Personal data transferred under these clauses may only be disclosed to the following categories of recipients: (i) Attributy's employees, agents, affiliates, advisors, and independent contractors with a reasonable business purpose for processing such personal data; (ii) Attributy vendors that, in their performance of their obligations to Attributy, must process such personal data acting on behalf of and according to instructions from Attributy; and (iii) any person (natural or legal) or organization to whom Attributy may be required by applicable law or regulation to disclose personal data, including law enforcement authorities and central and local government authorities.

2.4 2021 Standard Contractual Clauses. The parties agree that the 2021 Standard Contractual Clauses will apply to personal data that is transferred via the Services from the European Economic Area or Switzerland, either directly or via onward transfer, any country or recipient outside the European Economic Area or Switzerland that is: (a) not recognized by the European Commission (or, in the case of transfers from Switzerland, the competent authority for Switzerland) as providing an adequate level of protection for personal data and (b) not covered by the Attributy BCRs. For data transfers from the European Economic Area that are subject to the 2021 Standard Contractual Clauses, the 2021 Standard Contractual Clauses will be deemed entered into (and incorporated into this Addendum by this reference) and completed as follows:

• (a) Module One (Controller to Controller) of the 2021 Standard Contractual Clauses will apply where (i) Attributy is processing Customer Account Data and (ii) Customer is a controller of Customer Usage Data, and Attributy is processing Customer Usage Data.
• (b) Module Two (Controller to Processor) of the 2021 Standard Contractual Clauses will apply where Customer is a controller of Customer Content, and Attributy is processing Customer Content.
• (c) Module Three (Processor to Processor) of the 2021 Standard Contractual Clauses will apply where Customer is a processor of Customer Content, and Attributy is processing Customer Content.
• (d) Module Four (Processor to Controller) of the 2021 Standard Contractual Clauses will apply where Customer is a processor of Customer Usage Data and Attributy processes Customer Usage Data.

(e) For each Module, where applicable:

• (i) Clause 7: the optional docking clause will not apply;
• (ii) Clause 9: Option 2 will apply and the time period for prior notice of sub-processor changes will be as set forth in Section 7.2 (Current Sub-processors and Notification of Sub-processor Changes) of this Addendum;
• (iii) Clause 11: the optional language will not apply;
• (iv) Clause 17 (Option 1): the 2021 Standard Contractual Clauses will be governed by Irish law;
• (v) Clause 18(b): disputes will be resolved before the courts of Ireland;

(vi) In Annex I, Part A:

• Data Exporter: Customer.
• Contact details: The email address(es) designated by Customer in Customer's account via its notification preferences.
• Data Exporter Role: As set forth in Section 2 (Relationship of the Parties) of this Addendum.
• Signature and Date: By entering into the Agreement, Data Exporter is deemed to have signed these Standard Contractual Clauses incorporated herein, including their Annexes, as of the Effective Date of the Agreement.
• Data Importer: Attributy Inc.
• Contact details: Attributy Privacy Team - [email protected]
• Data Importer Role: As set forth in Section 2 (Relationship of the Parties) of this Addendum.
• Signature and Date: By entering into the Agreement, Data Importer is deemed to have signed these Standard Contractual Clauses, incorporated herein, including their Annexes, as of the Effective Date of the Agreement.

(vii) In Annex I, Part B:

• The categories of data subjects are described in Section 4 of Schedule 1 (Details of Processing) of this Addendum.
• The Sensitive Data transferred is described in Section 6 of Schedule 1 (Details of Processing) of this Addendum.
• The frequency of the transfer is a continuous basis for the duration of the Agreement.
• The nature of the processing is described in Section 1 of Schedule 1 (Details of Processing) of this Addendum.
• The purpose of the processing is described in Section 1 of Schedule 1 (Details of Processing) of this Addendum.
• The period for which the personal data will be retained is described in Section 3 of Schedule 1 (Details of Processing) of this Addendum.

(viii) In Annex I, Part C: The Irish Data Protection Commission will be the competent supervisory authority.

(ix) Schedule 2 (Technical and Organizational Security Measures) of this Addendum serves as Annex II of the Standard Contractual Clauses.

2.6 Conflict. To the extent there is any conflict between the Standard Contractual Clauses and any other terms in this Addendum, including Schedule 4 (Jurisdiction Specific Terms) of this Addendum, the Agreement, or the Privacy Policy, the provisions of the Standard Contractual Clauses will prevail.

1. Australia:

• 1.1 The definition of "Applicable Data Protection Law" includes the Australian Privacy Principles and the Australian Privacy Act (1988).
• 1.2 The definition of "personal data" includes "Personal Information" as defined under Applicable Data Protection Law.
• 1.3 The definition of "Sensitive Data" includes "Sensitive Information" as defined under Applicable Data Protection Law.

2. Brazil:

• 2.1 The definition of "Applicable Data Protection Law" includes the Lei Geral de Proteção de Dados (LGPD).
• 2.2 The definition of "Security Incident" includes a security incident that may result in any relevant risk or damage to data subjects.
• 2.3 The definition of "processor" includes "operator" as defined under Applicable Data Protection Law.

3. California:

• 3.1 The definition of "Applicable Data Protection Law" includes the California Consumer Privacy Act (CCPA).
• 3.2 The definition of "personal data" includes "Personal Information" as defined under Applicable Data Protection Law and, for clarity, contains any Personal Information contained within Customer Account Data, Customer Content, and Customer Usage Data.
• 3.3 The definition of "data subject" includes "Consumer" as defined under Applicable Data Protection Law. As described in Section 8 (Data Subject Rights) of this Addendum, any data subject rights apply to Consumer rights. Regarding data subject requests, Attributy can only verify a request from the Customer and not from the Customer's end-user or any third party.
• 3.4 The definition of "controller" includes "Business" as defined under Applicable Data Protection Law.
• 3.5 The definition of "processor" includes "Service Provider" as defined under Applicable Data Protection Law.
• 3.6 Attributy will process, retain, use, and disclose personal data only as necessary to provide the Services under the Agreement, which constitutes a business purpose. Attributy agrees not to (a) sell (as defined by the CCPA) Customer's personal data or Customer end users' personal data; (b) retain, use, or disclose Customer's personal data for any commercial purpose (as defined by the CCPA) other than providing the Services; or (c) retain, use, or disclose Customer's personal data outside of the scope of the Agreement. Attributy understands its obligations under the Applicable Data Protection Law and will comply with them.
• 3.7 Attributy certifies that its sub-processors, as described in Section 7 (Sub-processors) of this Addendum, are Service Providers under Applicable Data Protection Law, with whom Attributy has entered into a written contract that includes terms substantially similar to this Addendum. Attributy conducts appropriate due diligence on its sub-processors.
• 3.8 Attributy will implement and maintain reasonable security procedures and practices appropriate to the nature of the personal data it processes as set forth in Section 11 (Security) of this Addendum.

4. Canada:

• 4.1 The definition of "Applicable Data Protection Law" includes the Federal Personal Information Protection and Electronic Documents Act (PIPEDA).
• 4.2 Attributy's sub-processors, as described in Section 7 (Sub-processors) of this Addendum, are third parties under Applicable Data Protection Law, with whom Attributy has entered into a written contract that includes terms substantially similar to this Addendum. Attributy has conducted appropriate due diligence on its sub-processors.
• 4.3 Attributy will implement technical and organizational measures as set forth in Section 11 (Security) of this Addendum.

5. European Economic Area (EEA):

• 5.1 The definition of "Applicable Data Protection Law" includes the General Data Protection Regulation (EU 2016/679) ("GDPR").
• 5.2 When Attributy engages a sub-processor under Section 7.1 (Authorization for Onward Sub-processing) of this Addendum, it will:
  • (a) require any appointed sub-processor to protect the Customer Content to the standard required by Applicable Data Protection Law, such as including the same data protection obligations referred to in Article 28(3) of the GDPR, in particular providing sufficient guarantees to implement appropriate technical and organizational measures in such a manner that the processing will meet the requirements of the GDPR; and
  • (b) require any appointed sub-processor to (i) agree in writing to only process personal data in a country that the European Union has declared to have an "adequate" level of protection or (ii) only process personal data on terms equivalent to the Standard Contractual Clauses or pursuant to a Binding Corporate Rules approval granted by competent European Union data protection authorities.
• 5.3 Notwithstanding anything to the contrary in this Addendum or in the Agreement (including, without limitation, either party's indemnification obligations), neither party will be responsible for any GDPR fines issued or levied under Article 83 of the GDPR against the other party by a regulatory authority or governmental body in connection with such other party's violation of the GDPR.
• 5.4 Customer acknowledges that Attributy, as a controller, may be required under Applicable Data Protection Law to notify a regulatory authority of Security Incidents involving Customer Usage Data. If a regulatory authority requires Attributy to notify impacted data subjects with whom Attributy does not have a direct relationship (e.g., Customer's end users), Attributy will notify Customer of this requirement. The Customer will provide reasonable assistance to Attributy to inform the impacted data subjects.

6. Israel:

• 6.1 The definition of "Applicable Data Protection Law" includes the Protection of Privacy Law (PPL).
• 6.2 The definition of "controller" includes "Database Owner" as defined under Applicable Data Protection Law.
• 6.3 The definition of "processor" includes "Holder" as defined under Applicable Data Protection Law.
• 6.4 Attributy will require that any person authorized to process Customer Content complies with the principle of data secrecy and has been duly instructed about Applicable Data Protection Law. Such personnel sign confidentiality agreements with Attributy in accordance with Section 6 (Confidentiality) of this Addendum.
• 6.5 Attributy must take adequate steps to ensure the privacy of data subjects by implementing and maintaining the security measures as specified in Section 11 (Security) of this Addendum and complying with the terms of the Agreement.
• 6.6 Attributy must ensure that the personal data will not be transferred to a sub-processor unless such sub-processor has executed an agreement with Attributy pursuant to Section 7.1 (Authorization for Onward Sub-processing) of this Addendum.

7. Japan:

• 7.1 The definition of "Applicable Data Protection Law" includes the Act on the Protection of Personal Information (APPI).
• 7.2 The definition of "personal data" includes "Personal Information" as defined under Applicable Data Protection Law.
• 7.3 The definition of "controller" includes "Business Operator" as defined under Applicable Data Protection Law. As a Business Operator, Attributy is responsible for the handling of personal data in its possession.
• 7.4 The definition of "processor" includes a business operator entrusted by the Business Operator with the handling of personal data in whole or in part (also a "trustee"), as described under Applicable Data Protection Law. As a trustee, Attributy will ensure that the use of the entrusted personal data is securely controlled.

8. Mexico:

• 8.1 The definition of "Applicable Data Protection Law" includes the Federal Law for the Protection of Personal Data Held by Private Parties and its Regulations (FLPPIPPE).
• 8.2 When acting as a processor, Attributy will:
  • (a) treat personal data in accordance with Customer's instructions set forth in Section 5 (Customer Instructions) of this Addendum;
  • (b) process personal data only to the extent necessary to provide the Services;
  • (c) implement security measures in accordance with Applicable Data Protection Law and Section 11 (Security) of this Addendum;
  • (d) keep confidentiality regarding the personal data processed in accordance with the Agreement;
  • (e) delete all personal data upon termination of the Agreement in accordance with Section 10 (Return or Deletion of Customer Content) of this Addendum; and
  • (f) only transfer personal data to sub-processors in accordance with Section 7 (Sub-processors) of this Addendum.

9. Singapore:

• 9.1 The definition of "Applicable Data Protection Law" includes the Personal Data Protection Act 2012 (PDPA).
• 9.2 Attributy will process personal data to a standard of protection in accordance with the PDPA by implementing adequate technical and organizational measures as set forth in Section 11 (Security) of this Addendum and complying with the terms of the Agreement.

10. Switzerland:

• 10.1 The definition of "Applicable Data Protection Law" includes the Swiss Federal Act on Data Protection.
• 10.2 When Attributy engages a sub-processor under Section 7.1 (Authorization for Onward Sub-processing) of this Addendum, it will:
  • (a) require any appointed sub-processor to protect the Customer Content to the standard required by Applicable Data Protection Law, such as including the same data protection obligations referred to in Article 28(3) of the GDPR, in particular providing sufficient guarantees to implement appropriate technical and organizational measures in such a manner that the processing will meet the requirements of the GDPR; and
  • (b) require any appointed sub-processor to (i) agree in writing to only process personal data in a country that the European Union has declared to have an "adequate" level of protection or (ii) only process personal data on terms equivalent to the Standard Contractual Clauses or pursuant to a Binding Corporate Rules approval granted by competent European Union data protection authorities.

11. United Kingdom (UK):

• 11.1 References in this Addendum to GDPR will, to that extent, be deemed to be references to the corresponding laws of the United Kingdom (including the UK GDPR and Data Protection Act 2018).
• 11.2 When Attributy engages a sub-processor under Section 7.1 (Authorization for Onward Sub-processing) of this Addendum, it will:
  • (a) require any appointed sub-processor to protect the Customer Content to the standard required by Applicable Data Protection Law, such as including the same data protection obligations referred to in Article 28(3) of the GDPR, in particular providing sufficient guarantees to implement appropriate technical and organizational measures in such a manner that the processing will meet the requirements of the GDPR; and
  • (b) require any appointed sub-processor to (i) agree in writing to only process personal data in a country that the United Kingdom has declared to have an "adequate" level of protection or (ii) only process personal data on terms equivalent to the Standard Contractual Clauses or pursuant to a Binding Corporate Rules approval granted by competent United Kingdom data protection authorities.
• 11.3 Notwithstanding anything to the contrary in this Addendum or in the Agreement (including, without limitation, either party's indemnification obligations), neither party will be responsible for any UK GDPR fines issued or levied under Article 83 of the UK GDPR against the other party by a regulatory authority or governmental body in connection with such other party's violation of the UK GDPR.
• 11.4 Customer acknowledges that Attributy, as a controller, may be required under Applicable Data Protection Law to notify a regulatory authority of Security Incidents involving Customer Usage Data. If a regulatory authority requires Attributy to notify impacted data subjects with whom Attributy does not have a direct relationship (e.g., Customer's end users), Attributy will notify Customer of this requirement. Customers provide reasonable assistance to Attributy to inform the impacted data subjects.