DATA PROCESSING AGREEMENT (OEM)

Version 1.0, published at https://adure.io/dpa-oem.

This Data Processing Agreement ("DPA") is entered into between Adure BV, with its registered office at Kleitstraat 24A, 9930 Lievegem, Belgium, registered with the Crossroads Bank for Enterprises under number BE1030 018 353 (the "Processor"), and the Customer identified in the applicable Order Form (the "Controller") (each a "Party" and together the "Parties").

This DPA is incorporated into the Agreement by reference and applies without separate signature. The Order Form identifies the Parties and records their agreement to this DPA.

WHEREAS

(A) The App does not operate solely within the Controller's own platform environments: the Processor hosts and operates the environment in which the App runs, and processes the Controller's business data and the personal data of the Controller's customers, counterparties, employees and other end users ("Customer Personal Data") on the Processor's own infrastructure and on infrastructure the Processor licenses from its Sub-processors. The Processor therefore acts as a processor of Customer Personal Data within the meaning of Article 4(8) and Article 28 GDPR.

(B) The Parties have entered into the Adure BV Master Subscription Agreement (the "Agreement"), under which the Processor provides the Controller with access to the Services (as defined in the Agreement).

(C) In addition to Customer Personal Data, the Processor processes limited Personal Data of the Controller's own designated administrators, Users, and billing contacts for account administration, support, and invoicing purposes ("Account Data", as further described in Annex 1).

(D) The Processor has represented that it has the necessary competence, capacity and resources to carry out this processing in compliance with applicable data protection legislation, and provides sufficient guarantees to implement appropriate technical and organisational measures as required by Article 28(1) GDPR.

(E) This DPA is a separate document from, but forms an integral part of and is incorporated by reference into, the Agreement. It applies for as long as the Processor processes Personal Data on the Controller's behalf under the Agreement. Terms not defined in this DPA have the meaning given in the Agreement.

THE PARTIES HAVE AGREED AS FOLLOWS:

1. DEFINITIONS

"Account Data" means the Personal Data the Processor processes for account administration, support, and invoicing purposes --- namely, the name, business contact details, and role of the Controller's designated administrators, Users, and billing or finance contacts.

"Agreement" means the Adure BV Master Subscription Agreement referred to in Recital (B), published at https://adure.io/master-subscription-agreement, including its Order Forms and Schedules.

"Customer Personal Data" means the Personal Data contained in the Controller's Data that the Processor processes on the Controller's behalf in the course of providing the Services, including Personal Data relating to the Controller's own customers, counterparties, employees and other end users. Customer Personal Data is hosted and processed on the Processor's own infrastructure and that of its Sub-processors, as described in Annex 1.

"Data Subject(s)" means the identified or identifiable natural person(s) to whom Personal Data relates.

"EEA" means the European Economic Area.

"GDPR" means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the General Data Protection Regulation), as may be amended, supplemented or replaced from time to time, together with any applicable Belgian implementing legislation.

"Personal Data" means, collectively, Customer Personal Data and Account Data.

"Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data.

"Special Categories of Personal Data" means Personal Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used for unique identification, data concerning health, or data concerning a natural person's sex life or sexual orientation, as referred to in Article 9 GDPR, and Personal Data relating to criminal convictions and offences referred to in Article 10 GDPR.

"Sub-processor" means any third party engaged by the Processor to process Personal Data on behalf of the Controller in connection with the Services, including any platform, hosting or infrastructure provider that the Processor --- and not the Controller --- licenses and contracts for. The current Sub-processors are listed in the Data Annex for the applicable App (Annex 3a).

"Supervisory Authority" means an independent public authority with responsibility for monitoring the application of the GDPR, including the Belgian Data Protection Authority.

2. SUBJECT MATTER AND SCOPE

2.1 The Controller is the controller and the Processor is the processor in respect of the Personal Data processed under this DPA. This DPA governs the Processor's processing of both Customer Personal Data and Account Data. The Processor hosts and processes Customer Personal Data on the Controller's behalf, and the obligations in this DPA apply in full to that processing.

2.2 The Processor shall process Personal Data solely in the name and on behalf of the Controller, and solely in accordance with the Controller's documented instructions, including with regard to transfers to a third country or an international organisation, unless required to do otherwise by Union or Belgian law, in which case the Processor shall inform the Controller of that legal requirement before processing, unless the law prohibits such information on important grounds of public interest.

2.3 The Agreement, this DPA (including Annex 1), the applicable Product Schedule and Data Annex, and any subsequent written instruction agreed by the Parties, constitute the Controller's complete documented instructions. Instructions outside that scope require prior written agreement between the Parties, and the Processor may charge reasonable compensation for implementing them in accordance with Article 5.6.

2.4 The Processor shall immediately inform the Controller if, in the Processor's opinion, an instruction infringes the GDPR or other Union or Member State data protection provisions. The Processor may suspend performance of the affected instruction, without liability, until the Controller confirms, withdraws or modifies it.

2.5 The Processor shall not use, edit, copy, disclose or otherwise process Personal Data beyond what is strictly necessary to perform the Agreement, and shall not process Personal Data for its own purposes. In particular, the Processor shall not sell Personal Data, use it for its own marketing, or use it to train machine-learning or artificial-intelligence models, except on the Controller's separate documented instruction.

2.6 The subject matter, duration, nature and purpose of the processing, the types of Personal Data, the categories of Data Subjects, and the locations of processing are set out in Annex 1 (as completed by the Data Annex for the applicable App). The Parties shall update Annex 1 by mutual written agreement if any of these elements change. The Processor shall promptly inform the Controller in writing if it becomes aware that any element of Annex 1 requires updating.

2.7 The Controller warrants that (i) it has a valid legal basis under Articles 6 and, where applicable, 9 and 10 GDPR for the processing it instructs, (ii) it has provided all notices and obtained all consents required for the Processor and its Sub-processors to process Personal Data as contemplated by the Agreement, and (iii) the Controller's Data is accurate and lawfully collected. The Controller shall indemnify the Processor against losses, expenses and liabilities arising directly from the Controller's breach of this warranty.

2.8 The Controller shall not instruct the processing of Special Categories of Personal Data unless the Parties have expressly agreed in writing, recorded that agreement in Annex 1, and implemented the additional measures in Annex 3.

3. CONFIDENTIALITY

3.1 The Processor shall treat all Personal Data, and the existence and content of the processing carried out on the Controller's behalf, as strictly confidential.

3.2 The Processor shall ensure that persons authorised to process Personal Data (including employees, contractors and Sub-processors) have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and shall grant access only on a need-to-know basis and only to the extent required to perform the Agreement.

3.3 The Processor shall ensure that persons authorised to process Personal Data receive appropriate training on their obligations under this DPA and applicable data protection law, and shall maintain a record of the categories of persons holding such access.

3.4 This duty of confidentiality survives termination of this DPA for a period of five (5) years, save that it shall continue indefinitely with respect to any Personal Data that has not been deleted or returned in accordance with Article 11.

4. SUB-PROCESSORS

4.1 The Controller grants the Processor a general written authorisation to engage Sub-processors to process Personal Data, subject to this Article 4. Under the OEM model, the platform, hosting and infrastructure providers on which the App runs are licensed and contracted for by the Processor and are therefore Sub-processors of the Processor. This includes the Salesforce Platform to the extent the Processor provides it to the Controller under an embedded or OEM licence held by the Processor. The current Sub-processors are listed in Annex 3a (being the Sub-processor list in the Data Annex for the applicable App).

4.2 The Processor shall maintain an up-to-date list of Sub-processors and shall notify the Controller in writing of any intended addition or replacement of a Sub-processor, giving the Controller a reasonable opportunity of no less than fourteen (14) days from the date of notice to object on reasonable data-protection grounds.

4.3 Where the Processor engages a Sub-processor, it shall do so by way of a written contract imposing on that Sub-processor data protection obligations no less protective of Personal Data than those set out in this DPA, in particular the obligation to provide sufficient guarantees to implement appropriate technical and organisational measures. The Processor remains fully liable to the Controller for the performance of that Sub-processor's obligations, and a failure by a Sub-processor is treated as a failure by the Processor itself.

4.4 The Processor shall, at the Controller's request, provide a copy of the relevant provisions of its agreement with a Sub-processor (redacted of commercially sensitive terms not relevant to data protection).

4.5 If the Controller objects to a new Sub-processor under Article 4.2, the Parties shall discuss in good faith a reasonable alternative that avoids the objected-to Sub-processor processing Personal Data. If the Processor is unable to offer such an alternative within thirty (30) days of the objection, the Controller may terminate the Agreement solely with respect to the Services that cannot be provided without that Sub-processor, by written notice to the Processor, and the Processor shall refund any prepaid Subscription Fees covering the remainder of the term for the terminated Services, without penalty to the Controller.

4.6 The Processor shall not permit any Sub-processor to engage a further sub-processor without imposing equivalent obligations, and remains liable to the Controller for any such further sub-processor on the same basis as under Article 4.3.

5. ASSISTANCE TO THE CONTROLLER

5.1 Data Subject requests. Taking into account the nature of the processing, the Processor shall assist the Controller by appropriate technical and organisational measures, insofar as reasonably possible, in fulfilling the Controller's obligations to respond to requests from Data Subjects exercising their rights under Chapter III GDPR (access, rectification, erasure, restriction, portability, objection, and rights relating to automated decision-making). Because the Processor hosts Customer Personal Data, this assistance includes providing the Controller with the functionality or support necessary to retrieve, correct, export, restrict or delete the relevant Personal Data.

5.2 The Processor shall notify the Controller without undue delay of any request it receives directly from a Data Subject relating to Personal Data, and shall not itself respond to such a request other than to confirm receipt and to direct the Data Subject to the Controller, unless authorised to do so by the Controller.

5.3 Where the Controller cannot action a Data Subject request through the standard functionality of the Services, the Processor shall action it on the Controller's documented instruction within a period allowing the Controller to meet its own statutory deadline, and in any event within ten (10) working days of the instruction.

5.4 Compliance assistance. The Processor shall assist the Controller in ensuring compliance with its obligations under Articles 32 to 36 GDPR (security of processing, notification of a Personal Data Breach to the Supervisory Authority and to Data Subjects, data protection impact assessments, and prior consultation), taking into account the nature of the processing and the information available to the Processor. Annex 4 describes the information the Processor shall provide for the purposes of a data protection impact assessment.

5.5 Records of processing. The Processor shall maintain a record of all categories of processing activities carried out on behalf of the Controller in accordance with Article 30(2) GDPR, and shall make that record available to the Controller and, on request, to the Supervisory Authority.

5.6 Where the Processor's assistance under this Article 5 requires materially more than reasonable effort integrated into the standard Services, the Processor may charge reasonable compensation for such assistance at its then-current professional services rates, to be agreed with the Controller in advance. No charge applies to assistance required as a result of the Processor's own breach of this DPA or of applicable data protection law.

5.7 Documentation. Upon the Controller's reasonable request, no more than once per calendar year, the Processor shall make available the information reasonably necessary to demonstrate compliance with this DPA and Article 28 GDPR, which may take the form of a written description of the technical and organisational measures then in place, relevant third-party certifications or audit reports the Processor then holds, and responses to a reasonable, standard information-security questionnaire.

5.8 Audit. The Controller (or an independent auditor mandated by it, provided such auditor is not a direct competitor of the Processor and is bound by confidentiality obligations no less protective than those in Article 3) may audit the Processor's compliance with this DPA, including by inspection of the premises and systems used to process Personal Data. Such audits (i) require at least thirty (30) days' prior written notice, except where prompted by an actual Personal Data Breach or by a requirement of the Controller's Supervisory Authority, in which case the notice period is such shorter period as is reasonable in the circumstances; (ii) shall be conducted no more than once per calendar year, except following an actual Personal Data Breach or where required by a Supervisory Authority; (iii) shall be carried out during normal business hours and in a manner that minimises disruption to the Processor's business; and (iv) shall be at the Controller's expense, including reasonable compensation for the Processor's time at its then-current professional services rates, save where the audit reveals a material breach of this DPA by the Processor, in which case the Processor shall bear its own costs and reimburse the Controller's reasonable audit costs. The Parties shall agree the scope, timing and duration of any audit before it begins.

5.9 The Processor shall submit to audits and inspections carried out by the Controller or its mandated auditor in accordance with Article 28(3)(h) GDPR, and shall contribute to such audits by making available the information described in Article 5.7.

6. PERSONAL DATA BREACH

6.1 The Processor shall notify the Controller without undue delay, and in any event within forty-eight (48) hours, after the Processor itself becomes aware of a Personal Data Breach affecting Personal Data processed on the Controller's behalf. The Processor is "aware" once it has a reasonable degree of certainty that a security incident has occurred that led to Personal Data being compromised. Where a Personal Data Breach originates with, or is first detected by, a Sub-processor, that period runs from the time the Processor itself becomes aware, and not from the time the Sub-processor became aware. The Processor shall require each Sub-processor to notify it of a Personal Data Breach without undue delay in accordance with Article 4.3, and a Sub-processor's delay in notifying the Processor does not of itself place the Processor in breach of this Article 6, provided the Processor has complied with Article 4.3 and notifies the Controller promptly upon becoming aware.

6.2 The notification shall describe, to the extent the information is available to the Processor: (i) the nature of the breach, including where possible the categories and approximate number of Data Subjects and Personal Data records concerned; (ii) the name and contact details of a contact point for further information; (iii) the likely consequences of the breach; and (iv) the measures taken or proposed to address the breach and mitigate its effects. Where not all information is available at the time of notification, the Processor shall provide it in phases without undue further delay.

6.3 The Processor shall provide reasonable assistance to the Controller, on a priority basis and at the Processor's own cost, in connection with the Controller's obligations to notify the breach to a Supervisory Authority under Article 33 GDPR and to affected Data Subjects under Article 34 GDPR, so as to enable the Controller to notify within seventy-two (72) hours of becoming aware.

6.4 The Processor shall take all reasonable steps to contain, investigate, remediate and mitigate the effects of the Personal Data Breach, and shall document the facts relating to the breach, its effects, and the remedial action taken. That documentation shall be made available to the Controller on request.

6.5 The Processor shall not notify any Supervisory Authority or Data Subject of a Personal Data Breach affecting the Controller's Personal Data on the Controller's behalf, or make any public statement identifying the Controller in connection with such a breach, without the Controller's prior written consent, unless required to do so by applicable law.

7. SECURITY MEASURES

7.1 The Processor shall implement and maintain the technical and organisational security measures described in Annex 2 to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access, taking into account the state of the art, implementation costs, the nature, scope, context and purposes of the processing, and the risk to the rights and freedoms of Data Subjects, in accordance with Article 32 GDPR.

7.2 The Processor shall review and update these measures periodically, and in any event at least annually and following any relevant security incident or material change to the Services. The Processor may update the measures in Annex 2 provided the level of protection is not thereby reduced.

7.3 The Processor shall maintain the ability to restore the availability of and access to Personal Data in a timely manner in the event of a physical or technical incident. For the App, that capability is provided by the resilience and restoration functions of the Salesforce Platform on which the App runs, as described in Article 11.6. The Processor shall test and evaluate the effectiveness of its security measures on a regular basis.

7.4 Where the Controller has not provided the Processor with sufficient information about the nature of the Personal Data or the associated risk to assess additional risk-specific measures, the Processor's obligation is limited to the measures described in Annex 2.

8. INTERNATIONAL TRANSFERS

8.1 The Processor shall process Personal Data within the EEA, at the locations set out in Annex 1, unless a transfer outside the EEA is permitted under this Article 8.

8.2 The Processor shall not transfer Personal Data outside the EEA, and shall not permit a Sub-processor to do so, unless (i) the transfer is to a country benefiting from an adequacy decision of the European Commission, (ii) the transfer is subject to appropriate safeguards under Article 46 GDPR, such as the European Commission's Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914, as updated from time to time, incorporated as Annex 5) or, where applicable, the UK International Data Transfer Addendum, or (iii) another valid transfer mechanism under Chapter V GDPR applies.

8.3 Where the Processor relies on Standard Contractual Clauses in respect of an onward transfer to a Sub-processor, it shall ensure the Sub-processor enters into the appropriate module of those Clauses (or an equivalent Article 46 mechanism), shall carry out and document a transfer impact assessment where required, and remains liable to the Controller for the Sub-processor's compliance.

8.4 A transfer required by mandatory Union or Belgian law shall be permitted without additional consent, provided the Processor notifies the Controller in advance in writing of the legal basis for the transfer, unless such notification is prohibited on important grounds of public interest.

8.5 To the extent Annex 5 applies to a transfer under this DPA, Annex 1 to this DPA serves as Annex I (List of Parties and Description of the Transfer) and Annex 2 to this DPA serves as Annex II (Technical and Organisational Measures) to those Clauses, and Annex 3a serves as the list of sub-processors authorised under Clause 9 (Use of Sub-processors). In the event of any conflict between the body of this DPA and Annex 5, Annex 5 shall prevail with respect to the transfer it governs.

9. GOVERNMENT AND THIRD-PARTY DATA REQUESTS

9.1 The Processor shall not disclose Personal Data to any law enforcement or government authority except where legally compelled to do so. If the Processor receives a legally binding request from such an authority for disclosure of Personal Data, the Processor shall, unless legally prohibited from doing so, (i) promptly notify the Controller before disclosure and provide a copy of the request, (ii) attempt to redirect the authority to request the Personal Data directly from the Controller, and (iii) if disclosure cannot be avoided, disclose only the minimum amount of Personal Data necessary to comply with the request.

9.2 Where the Processor is legally prohibited from notifying the Controller, it shall use best efforts to obtain a waiver of that prohibition and shall document the steps taken.

9.3 The Processor shall review the legality of any such request and shall challenge it where there are reasonable grounds to consider it unlawful, including by pursuing available avenues of appeal.

9.4 The Processor shall not provide any third party (i) direct, indirect, blanket or unfettered access to Personal Data, (ii) encryption keys used to secure Personal Data or any means to circumvent the Processor's encryption, or (iii) access to Personal Data where the Processor is aware that the data will be used for a purpose other than that stated in the request.

9.5 The Processor shall document requests for access to Personal Data received from public authorities, and the Processor's response, and shall make that documentation available to the Controller upon request to the extent legally permitted.

10. LIABILITY

10.1 Each Party is liable for damages caused by its own non-compliance with this DPA or with applicable data protection law, in accordance with Article 82 GDPR.

10.2 The Processor shall indemnify the Controller for damages, fines, administrative sanctions and reasonable legal costs arising from a third-party claim, a Supervisory Authority action, or a Data Subject claim, to the extent directly caused by the Processor's breach of this DPA or of its obligations as processor under the GDPR, including damages caused by a Sub-processor engaged by the Processor.

10.3 The Processor's total liability under this DPA, whether arising in one or more incidents, is subject to the same aggregate liability cap set out in Section 10 (Limitation of Liability) of the Agreement --- namely, the total Subscription Fees paid by the Controller in the twelve (12) months preceding the event giving rise to the liability. For the avoidance of doubt, this cap is a single aggregate cap shared with, and not in addition to, the cap in Section 10 of the Agreement.

10.4 The Processor shall maintain insurance covering the risks described in this Article 10, consistent with the insurance obligations set out in Section 12 (Insurance) of the Agreement, and shall provide evidence of coverage to the Controller on reasonable request.

10.5 Nothing in this Article 10 limits (i) either Party's liability for death or personal injury caused by negligence, fraud or fraudulent misrepresentation, (ii) any liability that cannot be limited or excluded under applicable law, or (iii) the Processor's liability to a Data Subject under Article 82 GDPR or under the third-party beneficiary rights in Annex 5, which cannot be limited by agreement between the Parties.

11. DURATION, DATA REMOVAL, AND TERMINATION

11.1 This DPA takes effect on the Effective Date of the Agreement, without separate signature, and remains in force for as long as the Processor processes Personal Data on the Controller's behalf under the Agreement. This DPA terminates automatically, without separate notice, upon termination or expiry of the Agreement.

11.2 Either Party may terminate this DPA immediately, without prejudice to its other rights and remedies, if the other Party is in material breach of this DPA and fails to remedy that breach within thirty (30) days of receiving written notice describing the breach.

11.3 Removal during the term. During the term of the Agreement, the Controller may at any time request the removal of specified Customer Personal Data held by the Processor, and the Processor shall action that request without undue delay and in any event within thirty (30) days, unless retention is required by Union or Belgian law.

11.4 Export and return. At any time during the term, and for a period of thirty (30) days following termination or expiry, the Controller may request the return of Customer Personal Data. The Processor shall provide it in a structured, commonly used and machine-readable format, at no charge for a single standard export per termination event.

11.5 Deletion on termination. Upon termination of this DPA, the Processor shall, at the Controller's choice, delete or return all Personal Data (including copies), and shall delete existing copies within thirty (30) days after the later of termination and the completion of any export requested under Article 11.4, unless applicable Union or Belgian law requires continued storage of some or all of the Personal Data, in which case the Processor shall isolate and protect that data from further processing and delete it once the legal retention requirement lapses. The Processor shall certify deletion in writing to the Controller on request.

11.6 Backups and residual copies. The App runs on the Salesforce Platform under an embedded OEM licence held by the Processor. The Processor does not take or maintain separate backup copies of Customer Personal Data; backup, replication and restoration are functions of the Salesforce Platform, which the Processor engages as a Sub-processor under Article 4. Any residual copies of Personal Data persisting within the Salesforce Platform after deletion under Article 11.5 are removed in accordance with that platform's own retention and deletion cycle, and remain subject to this DPA, and in particular to Articles 3 and 7, until removed. The Controller's own responsibility for maintaining backup copies of the Controller's Data is set out in Section 8.3 of the Agreement; if the Controller requires point-in-time backup or recovery beyond what the Salesforce Platform provides, that is procured separately and is not part of the Services.

11.7 Articles 3 (Confidentiality), 9 (Government and Third-Party Data Requests), 10 (Liability) and this Article 11 survive termination or expiry of this DPA.

12. GOVERNING LAW AND JURISDICTION

This DPA is governed exclusively by Belgian law. Disputes arising from this DPA shall be settled exclusively by the courts of the district of the Processor's registered seat, consistent with Section 13 (Notices, Governing Law and Jurisdiction) of the Agreement.

13. MISCELLANEOUS

13.1 If any provision of this DPA is held invalid, void or unenforceable, the remaining provisions remain in full force, and the Parties shall negotiate in good faith a replacement provision that most closely matches the purpose of the invalid provision.

13.2 Amendment. The Processor may publish an updated version of this DPA at the address stated at the head of this DPA only where the update (i) is required by applicable law, by a Supervisory Authority, or by a change to the Standard Contractual Clauses, or (ii) does not materially reduce the protections afforded to the Controller or to Data Subjects. The Processor shall give the Controller at least thirty (30) days' written notice of such an update, and the updated version takes effect on the date stated in the notice. If an update materially affects the Controller, the Controller may terminate the Agreement, without cost or penalty, by written notice given before the update takes effect. Any other amendment to this DPA is valid only if agreed in writing by both Parties. In addition, (i) the Parties may update Annexes 1, 3 and 3a by mutual written agreement (including by email) without amending the body of this DPA, and (ii) the Processor may update Annex 2 in accordance with Article 7.2, provided the level of protection is not reduced.

13.3 In the event of any conflict between this DPA and the Agreement regarding the processing of Personal Data, this DPA prevails; in all other respects, the Agreement governs the relationship between the Parties.

13.4 If the processing under this DPA, or the Parties' relationship, becomes subject to new data protection legislation or binding case law that materially affects this DPA, the Parties shall negotiate in good faith to bring this DPA into line with that legislation or case law.

13.5 If the Processor holds a relevant certification or adheres to an approved code of conduct regarding the processing of Personal Data, it shall maintain that certification or adherence for the duration of this DPA and shall notify the Controller if it lapses.

13.6 Compliance by each Party with its obligations under this DPA is free of charge, save for the reasonable compensation expressly provided for in Articles 5.6, 5.8 and elsewhere in this DPA.

Annex 1 -- Details of the Processing

The subject matter, duration, nature and purpose of the processing, the types of Customer Personal Data and Account Data, the categories of Data Subjects, and the location(s) of processing are set out in the Data Annex for the applicable App, which forms part of this DPA. Where the Standard Contractual Clauses in Annex 5 apply, this Annex 1 (as completed by the applicable Data Annex) serves as Annex I to those Clauses.

For an OEM App, the Data Annex must in addition identify: (i) the infrastructure and platform Sub-processors on which the App runs; (ii) the retention period applicable to Customer Personal Data; and (iii) whether Special Categories of Personal Data are processed and, if so, the additional measures agreed under Annex 3.

Annex 2 -- Technical and Organisational Security Measures

The Processor implements the following measures to protect Personal Data, in accordance with Article 32 GDPR. These measures apply to the Processor's own systems and to the environment in which the App is hosted.

Organisational measures

• Designated security responsibility within the organisation >• Documented information security policy, reviewed at least annually >• Staff confidentiality undertakings and periodic security-awareness training >• Documented incident response and breach-notification procedure, tested periodically >• Data classification and access-control policy, with access reviewed at least annually >• Joiner/mover/leaver process ensuring prompt revocation of access >• Business continuity and disaster-recovery plan, with defined recovery objectives >• Sub-processor due-diligence and periodic review process >• Periodic testing and evaluation of the effectiveness of these measures

Technical measures

• Encryption of Personal Data in transit (TLS 1.2 or higher) and at rest >• Logical separation of each Controller's data from that of other customers >• Role-based access control and the principle of least privilege >• Multi-factor authentication for administrative and remote access >• Logging and monitoring of access to systems processing Personal Data, with logs retained for a defined period and protected against tampering >• Regular patching and vulnerability management, with defined remediation timeframes by severity >• Periodic vulnerability scanning and, where proportionate to the risk, penetration testing >• Firewall and network segmentation >• Hardened configuration baselines for servers and endpoints >• Backup, replication and restoration provided by the Salesforce Platform on which the App runs; the Processor maintains no separate backup copies (Article 11.6) >• Secure development practices, including code review and separation of development, test and production environments >• Use of pseudonymisation or anonymisation where compatible with the purpose of the processing >• Secure deletion and media sanitisation procedures

Annex 3 -- Special Categories of Personal Data

This Annex applies only where the Parties have agreed in writing under Article 2.8 that the Processor processes Special Categories of Personal Data on the Controller's behalf; otherwise it does not apply.

1. Access list. The Processor shall maintain a list of the categories of persons authorised to access Special Categories of Personal Data, including their role, and shall make this list available to the Controller and the Supervisory Authority on request.
2. Data protection impact assessment. Where large-scale processing of Special Categories of Personal Data is contemplated, the Processor shall not begin such processing before the Controller has completed a data protection impact assessment, and shall provide the information described in Annex 4 to assist with that assessment.
3. Additional security measures. Given the sensitivity of this data, the Processor shall apply the measures in Annex 2 with particular rigour, including encryption at rest with segregated key management, enhanced logging of all access, and restricting access strictly to personnel with a demonstrable need to know.

Annex 3a -- Current Sub-processors

The Processor's Sub-processors fall into two categories:

(a) The Processor's own corporate Sub-processors --- those it engages to process Account Data within its own account, billing, support and contracting systems --- are set out in the Adure BV Sub-processors list, published at https://adure.io/sub-processors. That list applies to every Adure application, is maintained centrally, and forms part of this DPA.

(b) App-specific Sub-processors --- including the platform, hosting and infrastructure providers on which the App runs, which under the OEM model are licensed and contracted for by the Processor --- are listed in the Data Annex for the applicable App.

Where the Standard Contractual Clauses in Annex 5 apply, the Adure BV Sub-processors list together with the App-specific Sub-processors named in the Data Annex serves as Annex III to those Clauses. Additions and replacements in either category are subject to the notice and objection mechanism in Article 4.2.

Annex 4 -- Data Protection Impact Assessment Information

Where a data protection impact assessment is required, the Processor shall assist the Controller, upon request and insofar as reasonably possible given its role as processor, by providing:

• A systematic description of the envisaged processing operations carried out by the Processor >• Information relevant to assessing the necessity and proportionality of those processing operations >• Information relevant to assessing risks to Data Subjects' rights and freedoms arising from the Processor's processing >• A description of the measures the Processor has implemented to address those risks, including the safeguards and security measures described in Annex 2 >• Details of the Sub-processors involved, the locations of processing, and any international transfers

Annex 5 -- EU Standard Contractual Clauses

The standard contractual clauses set out in the Annex to Commission Implementing Decision (EU) 2021/914 of 4 June 2021 (the "Clauses") are incorporated into this DPA by reference in their official, unmodified form, and apply automatically, without further action by the Parties, to any transfer of Personal Data under this DPA that requires a transfer mechanism under Chapter V GDPR. The official text prevails over any summary or description of the Clauses.

The Parties adopt the Clauses as follows:

Where the Clauses apply, they prevail over the body of this DPA with respect to the transfer they govern, as set out in Article 8.5. The competent Supervisory Authority for the purposes of Clause 13 is the Supervisory Authority identified in Annex I, being by default the Belgian Data Protection Authority where the Controller is established in Belgium.

Version history