DATA PROCESSING ADDENDUM

THIS DATA PROCESSING ADDENDUM (“DPA”) to the Agreement is entered into as of the Addendum Effective Date by and between Roam HQ Inc. (“Roam”), a Delaware corporation with its principal business address at 40 Monroe Pl, Brooklyn, NY 11201 (“Vendor”); and the customer identified on the Enterprise Software-as-a-Service Agreement (“Customer”), together the “Parties” and each a “Party.”

1. INTERPRETATION

1.1. In this DPA the following terms shall have the meanings set out in this Section 1, unless expressly stated otherwise:

1. “Addendum Effective Date” means the effective date of the Agreement.
2. “Agreement” means the Enterprise Software-as-a-Service Agreement entered into by and between the Parties.
3. “Applicable Data Protection Laws” means the privacy, data protection and data security laws and regulations of any jurisdiction directly applicable to the Vendor’s Processing of Customer Personal Data under the Agreement, including, where applicable, GDPR, CCPA and LGPD.
4. “CCPA” means the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (the “CPRA”) and any binding regulations promulgated thereunder.
5. “Controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the Processing of Personal Data.
6. “Customer Personal Data” means any Personal Data Processed by Vendor or its SubProcessor on behalf of Customer to perform the Services under the Agreement.
7. “Data Subject” means the identified or identifiable natural person to whom Customer Personal Data relates.
8. “Data Subject Request” means the exercise by a Data Subject of its rights in accordance with Applicable Data Protection Laws in respect of Customer Personal Data and the Processing thereof.
9. “Deidentified Data” means data Processed by Vendor or its Sub-Processor on behalf of Customer to perform the Services under the Agreement that cannot reasonably be used to infer information about, or otherwise be linked to, an identified or identifiable natural person, or device linked to such person.
10. “EEA” means the European Economic Area.
11. “GDPR” means, as and where applicable to Processing concerned: (i) the General Data Protection Regulation (Regulation (EU) 2016/679) (“EU GDPR”); and/or (ii) the EU GDPR as it forms part of UK law by virtue of section 3 of the European Union (Withdrawal) Act 2018 (as amended, including by the Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019) (“UK GDPR”), including, in each case (i) and (ii) any applicable national implementing or supplementary legislation (e.g., the UK Data Protection Act 2018), and any successor, amendment or re-enactment, to or of the foregoing. References to “Articles” and “Chapters” of, and other relevant defined terms in, the GDPR shall be construed accordingly.
12. “LGPD” means the Brazilian Personal Data Protection Law (issued pursuant to Federal Law n° 13.709/2018) and resolutions issued by the National Data Protection Authority (“ANPD”).
13. “Personal Data” means any information provided to Vendor by Customer that is protected as “personal data,” “personal information,” “personally identifiable information” or similar term defined in Applicable Data Protection Laws, except that Personal Data does not include such information pertaining to Customer’s personnel or representatives who are business contacts of Customer (where Vendor acts as a controller of such information).
14. “Personal Data Breach” means a breach of Vendor’s security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Customer Personal Data in Vendor’s possession, custody or control. For clarity, Personal Data Breach does not include unsuccessful attempts or activities that do not compromise the security of Personal Data (such as unsuccessful log-in attempts, pings, port scans, denial of service attacks, or other network attacks on firewalls or networked systems).
15. “Personnel” means a person’s employees, agents, consultants or contractors.
16. “Process” and any inflection thereof means any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
17. “Processor” means a natural or legal person, public authority, agency or other body which Processes Personal Data on behalf of the Controller.
18. “Restricted Transfer” means the disclosure, grant of access or other transfer of Customer Personal Data to any person located in: (i) in the context of the EEA, any country or territory outside the EEA which does not benefit from an adequacy decision from the European Commission (an “EEA Restricted Transfer”); (ii) in the context of the UK, any country or territory outside the UK, which does not benefit from an adequacy decision from the UK Government (a “UK Restricted Transfer”), which would be prohibited without a legal basis under Chapter V of the GDPR; and (iii) in the context of Brazil, any country or territory outside Brazil, which does not benefit from an adequacy decision pursuant to Resolução CD/ANPD nº 19, of 23 August 2024 (a “Brazilian Restricted Transfer”).
19. “SCCs” means the standard contractual clauses approved by the European Commission pursuant to implementing Decision (EU) 2021/914.
20. “Services” means those services and activities to be supplied to or carried out by or on behalf of Vendor for Customer pursuant to the Agreement.
21. “Sub-Processor” means any third party appointed by or on behalf of Vendor to Process Customer Personal Data.
22. “Supervisory Authority”: (i) in the context of the EEA and the EU GDPR, shall have the meaning given to that term in the EU GDPR; (ii) in the context of the UK and the UK GDPR, means the UK Information Commissioner’s Office; and (iii) in the context of Brazil and the LGPD, means the ANPD.
23. “UK Transfer Addendum” means the template Addendum B.1.0 issued by the ICO and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022, as it is revised under Section 18 of the UK Mandatory Clauses included in Part 2 thereof (the “UK Mandatory Clauses”).

1.2. Unless otherwise defined in this DPA, all capitalized terms in this DPA shall have the meaning given to them in the Agreement.

2. SCOPE OF THIS DATA PROCESSING ADDENDUM

2.1. This DPA applies generally to Vendor’s Processing of Customer Personal Data under the Agreement.

2.2. The Parties acknowledge and agree that the details of Vendor’s Processing of Customer Personal Data (including the respective roles of the Parties relating to such Processing) are as described in Annex 1 (Data Processing Details) to the DPA.

2.3. Annex 2 (European Annex) to this DPA applies only if and to the extent Vendor’s Processing of Customer Personal Data under the Agreement is subject to the GDPR.

2.4. Annex 3 (California Annex) to this DPA applies only if and to the extent Vendor’s Processing of Customer Personal Data under the Agreement is subject to the CCPA with respect to which Customer is a “business” (as defined in the CCPA).

2.5. Section 9 (Compliance Assistance; Audits) of this DPA applies to Vendor’s Processing of Customer Personal Data to the extent required under Applicable Data Protection Laws for contracts with Processors, and in such cases, only in respect of Processing of Personal Data subject to such laws.

2.6 Annex 5 (Brazil Annex) to this DPA applies only if and to the extent Vendor’s Processing of Customer Personal Data under the Agreement is subject to the LGPD.

3. PROCESSING OF CUSTOMER PERSONAL DATA

3.1. Vendor shall not Process Customer Personal Data other than on Customer’s written instructions or as required or permitted by applicable laws and Vendor shall be considered a “processor” or “service provider” as defined under Applicable Data Protection Laws.

3.2. Customer instructs Vendor to Process Customer Personal Data to provide the Services to Customer and in accordance with the Agreement and this DPA. The Agreement and this DPA are a complete expression of such instructions, and Customer’s additional instructions will be binding on Vendor only pursuant to any written amendment to this DPA signed by both Parties. Where required by Applicable Data Protection Laws, if Vendor receives an instruction from Customer that, in its reasonable opinion, infringes Applicable Data Protection Laws, Vendor shall notify Customer.

3.3. The Parties acknowledge that Vendor’s Processing of Customer Personal Data authorized by Customer’s instructions stated in this DPA are integral to the Services and the business relationship between the Parties. Access to Personal Data does not form part of the consideration exchanged between the Parties in respect of the Agreement or any other business dealings.

4. VENDOR PERSONNEL

4.1. Vendor shall take commercially reasonable steps to ascertain the reliability of any Vendor Personnel who Process Customer Personal Data and, where required by applicable laws, shall enter into written confidentiality agreements with all Vendor Personnel who Process Customer Personal Data that are not subject to professional or statutory obligations of confidentiality.

5. SECURITY

5.1. Vendor shall implement and maintain technical and organizational measures in relation to Customer Personal Data designed to protect Customer Personal Data against Personal Data Breaches as described in Annex 4 (Security Measures) (the “Security Measures”).

5.2. Vendor may update the Security Measures from time to time, provided the updated measures do not materially decrease the overall protection of Customer Personal Data.

6. DATA SUBJECT REQUESTS

6.1. Taking into account the nature of the Processing of Customer Personal Data by Vendor, Vendor shall provide Customer with such assistance by implementing appropriate technical and organizational measures to assist Customer in fulfilling its obligations under Applicable Data Protection Laws to respond to Data Subject Requests.

6.2. Vendor shall:

1. promptly notify Customer if it receives a Data Subject Request; and
2. not respond to any Data Subject Request, other than to advise the Data Subject to submit the request to Customer, except on the written instructions of Customer or as required by Applicable Data Protection Laws.

6.3. Where a Data Subject Request is made by a Data Subject whose Customer Personal Data is subject to the LGPD, the assistance described in Paragraph 6.1 above includes reasonable assistance to enable Customer to respond to the Data Subject's exercise of the rights set out in Article 18 of the LGPD, including, as applicable, (i) confirmation of the existence of Processing, (ii) access to the relevant Customer Personal Data, (iii) anonymization, blocking or deletion of unnecessary or excessive data or data Processed in non-compliance with the LGPD, (iv) portability of the data to another supplier of service or product, (v) information about entities with which Customer has shared data, (vi) information on the possibility of not providing consent and the consequences of doing so, (vii) withdrawal of consent, and (viii) review of decisions made solely on the basis of automated Processing of Customer Personal Data.

7. PERSONAL DATA BREACH

Breach notification and assistance

7.1. Vendor shall notify Customer without undue delay upon Vendor’s confirmation of a Personal Data Breach affecting Customer Personal Data. Vendor’s notification of or response to a Personal Data Breach shall not be construed as Vendor’s acknowledgement of any fault or liability with respect to the Personal Data Breach.

7.2. To the extent the Personal Data Breach resulted from Vendor’s breach of its security obligations under the Agreement, Vendor shall provide Customer with reasonably requested information (insofar as such information is within Vendor’s possession and knowledge and does not otherwise compromise the security of any Personal Data Processed by Vendor) to allow Customer to meet its obligations under the Applicable Data Protection Laws to report the Personal Data Breach. If the Personal Data Breach did not result from Vendor’s breach of its security obligations under the Agreement, Vendor shall reasonably cooperate with Customer, provided, however, Customer shall reimburse Vendor for any costs incurred by Vendor. Customer is solely responsible for complying with notification laws applicable to Customer and fulfilling any third-party notification obligations related to any Personal Data Breaches.

Notification to Vendor

7.3. If Customer determines that a Personal Data Breach must be notified to any Supervisory Authority or other governmental authority, any Data Subject(s), the public or others under Applicable Data Protection Laws, to the extent such notice directly or indirectly refers to or identifies Vendor, where permitted by applicable laws, Customer agrees to:

1. notify Vendor in advance in writing; and
2. in good faith, consult with Vendor and consider any clarifications or corrections Vendor may reasonably recommend or request to any such notification, which: (i) relate to Vendor’s involvement in or relevance to such Personal Data Breach; and (ii) are consistent with applicable laws.

7.4. Where a Personal Data Breach affects Customer Personal Data that is subject to the LGPD, Vendor's notification under Paragraph 7.1 above shall, to the extent the relevant information is available to Vendor, be limited to: (a) a description of Personal Data Breach and the nature and category of the Customer Personal Data affected; (b) the number and category of Data Subjects affected, including specifying whether children, adolescents or elderly persons are affected; (c) the technical and security measures used to protect Customer Personal Data adopted before and after the Personal Data Breach; (d) the risks related to the Personal Data Breach; (e) the measures that have been or will be adopted to mitigate the effects of the Personal Data Breach; (f) the date on which the Personal Data Breach occurred and on which Vendor became aware of it; (g) details of the Vendor’s Data Protection Officer; and (viii) number of Data Subjects whose data is Processed in the Processing activities affected, in each case as required by Article 6, § 2 of Resolução CD/ANPD nº 15, of 24 April 2024.

8. SUB-PROCESSING

8.1. Customer generally authorizes Vendor to appoint Sub-processors in accordance with this Section 8. Without limitation to the foregoing, Customer authorizes the engagement of the Sub-processors listed as of the effective date of the Agreement at the Subprocessor Site.

8.2. Information about Sub-processors, including their functions and locations, is available at: https://ro.am/subprocessors (as may be updated by Vendor from time to time, subject to Vendor’s obligations pursuant to Section 8.4 below) or such other website address as Vendor may provide to Customer from time to time (the “Subprocessor Site”).

8.3. When engaging any Sub-processor, where required by Applicable Data Protection Laws, Vendor will enter into a written contract with such Sub-processor containing data protection obligations similar to or not less protective than those in this DPA with respect to Customer Personal Data and to the extent applicable to the nature of the services provided by such Sub-processor. As between the Parties, Vendor shall be liable for the acts and omissions of all Sub-processors under or in connection with this DPA to the same extent Vendor would be liable under the terms of this DPA if performing such services itself directly.

8.4. When Vendor engages any Sub-processor after the effective date of the Agreement, Vendor will notify Customer of the engagement (including the name and location of the relevant Sub-processor and the activities it will perform) by updating the Subprocessor Site or by other written means at least 15 days before such Sub-processor Processes Customer Personal Data. If Customer objects to such engagement in a written notice to Vendor within 15 days after being notified of the engagement on reasonable grounds relating to the protection of Customer Personal Data, Customer and Vendor will work together in good faith to consider a mutually acceptable resolution to such objection. If the Parties are unable to reach a mutually agreeable resolution within a reasonable timeframe, Customer may, within 30 days of its initial notification of its objection to Vendor, as its sole and exclusive remedy, terminate the Agreement and cancel the Services by providing written notice to Vendor and pay Vendor for all amounts due and owing under the Agreement as of the date of such termination. If Customer does not object to Vendor’s appointment of a Sub-processor during the objection period referred to in this Section 8.4, or if Customer separately agrees to the use of a feature requiring the use of a Sub-processor, Customer shall be deemed to have approved the engagement and ongoing use of that Sub-processor.

9. COMPLIANCE ASSISTANCE; AUDITS

9.1. Taking into account the nature of the Processing of Customer Personal Data by Vendor and the information available to Vendor, Vendor shall provide such information and assistance to Customer as Customer may reasonably request (insofar as such information is available to Vendor and the sharing thereof does not compromise the security, confidentiality, integrity or availability of Personal Data Processed by Vendor) to help Customer meet its obligations under Applicable Data Protection Laws, including in relation to the security of Customer Personal Data, the reporting and investigation of Personal Data Breaches, the demonstration of Customer’s compliance with such obligations, and the performance of any data protection assessments and consultations with Supervisory Authorities or other government authorities regarding such assessments in relation to Vendor’s Processing of Customer Personal Data, including those required under Articles 35 and 36 of the GDPR.

9.2. Subject to Section 9.4 below, Vendor shall make available to Customer such information as Customer may reasonably request for Vendor to demonstrate compliance with Applicable Data Protection Laws and this DPA. Without limitation of the foregoing, Customer may conduct (in accordance with Section 9.3), at its sole cost and expense, and Vendor will reasonably cooperate with, reasonable audits (including inspections, manual reviews, and automated scans and other technical and operational testing that Customer is entitled to perform under Applicable Data Protection Laws), in each case, whereby Customer or a qualified and independent auditor appointed by Customer using an appropriate and accepted audit control standard or framework may audit Vendor’s technical and organizational measures in support of such compliance and the auditor’s report is provided to Customer and Vendor upon Customer’s request.

9.3. Customer shall give Vendor reasonable advance notice of any such audits. Vendor need not cooperate with any audit (a) performed by any individual or entity who has not entered into a non-disclosure agreement with Vendor on terms acceptable to Vendor in respect of information obtained in relation to the audit; (b) conducted outside of Vendor’s normal business hours at the relevant site; or (c) on more than one occasion in any calendar year during the term of the Agreement, except for any additional audits that Customer is required to perform under Applicable Data Protection Laws. The audit must be conducted in accordance with Vendor’s safety, security or other relevant policies, must not impact the security, confidentiality, integrity or availability of any data Processed by Vendor, and must not unreasonably interfere with Vendor’s business activities. Customer shall not conduct any scans or technical or operational testing of Vendor’s applications, websites, services, networks or systems without Vendor’s prior approval (which shall not be unreasonably withheld).

9.4. If the controls or measures to be assessed in the requested audit are assessed in a SOC 2 Type 2, ISO, NIST or similar audit report performed by a qualified and independent third-party auditor pursuant to a recognized industry standard audit framework within twelve (12) months of Customer’s audit request (“Audit Report”) and Vendor has confirmed in writing that there have been no known material changes to the controls audited and covered by such Audit Report(s), Customer agrees to accept provision of such Audit Report(s) in lieu of requesting an audit of such controls or measures. Vendor shall provide copies of any such Audit Reports to Customer upon request.

9.5. Such Audit Reports and any other information obtained by Customer in connection with an audit under this Section 9 shall constitute the confidential information of Vendor, which Customer shall use only for the purposes of confirming compliance with the requirements of this DPA or meeting Customer’s obligations under Applicable Data Protection Laws. Nothing in this Section 9 shall be construed to obligate Vendor to breach any duty of confidentiality.

10. RETURN AND DELETION

10.1. Upon expiration or earlier termination of the Agreement, Vendor shall cease all Processing of Customer Personal Data for any purpose other than for storage.

10.2. Customer hereby acknowledges and agrees that, due to the nature of the Customer Personal Data Processed by Vendor, return (as opposed to deletion) of Customer Personal Data is not a reasonably practicable option in the circumstances. Having regard to the foregoing, Customer agrees that it is hereby deemed to have irrevocably selected deletion, in preference of return, of Customer Personal Data for the purposes of Applicable Data Protection Laws.

10.3. To the fullest extent technically possible in the circumstances, within 30 days after expiration or earlier termination of the Agreement, Vendor shall either (at its option): (a) delete; or (b) irreversibly anonymize or deidentify, all Customer Personal Data in Vendor’s care, custody or control.

10.4. Notwithstanding the foregoing, Vendor may retain Customer Personal Data where required by law (or in the case of Customer Personal Data subject to the GDPR, the laws of the UK or European Union, as applicable), provided that Vendor shall (a) maintain the confidentiality of all such Customer Personal Data and (b) Process the Customer Personal Data only as necessary for the purpose(s) and duration specified in the applicable law requiring such retention.

11. CUSTOMER’S RESPONSIBILITIES

11.1. Customer agrees that, without limiting Vendor’s obligations under Section 5 (Security), Customer is solely responsible for its use of the Services, including (a) making appropriate use of the Services to maintain a level of security appropriate to the risk in respect of the Customer Personal Data; (b) securing the account authentication credentials, systems and devices Customer uses to access the Services; (c) securing Customer’s systems and devices that Vendor uses to provide the Services; and (d) backing up Customer Personal Data.

11.2. Customer shall ensure:

1. that there is, and will be throughout the term of the Agreement, a valid legal basis for the Processing by Vendor of Customer Personal Data in accordance with this DPA and the Agreement (including, any and all instructions issued by Customer from time to time in respect of such Processing) for the purposes of all Applicable Data Protection Laws (including Article 6, Article 9(2) and/or Article 10 of the GDPR (where applicable)); and
2. that (and is solely responsible for ensuring that) all required notices have been given to, and all consents and permissions have been obtained from, Data Subjects and others as required by Applicable Data Protection Laws, relating to the Processing by Vendor of Customer Personal Data.

11.3. Customer agrees that the Services, the Security Measures, and Vendor’s commitments under this DPA are adequate to meet Customer’s needs, including with respect to any security obligations of Customer under Applicable Data Protection Laws, and provide a level of security appropriate to the risk in respect of the Customer Personal Data.

11.4. Customer shall not, and agrees to ensure its Authorized Users do not, provide or otherwise make available to Vendor, through or while using the Services, any Customer Personal Data that contains any (a) protected health information subject to the Health Insurance Portability and Accountability Act (HIPAA) (unless specifically covered by an executed Business Associate Agreement between Customers and Vendor); or (b) Personal Data of children under 13 years of age in the United States or under 16 years of age outside of the United States (together, “Restricted Data”).

11.5. Except to the extent prohibited by applicable law, Customer shall compensate Vendor at Vendor’s then-current professional services rates for, and reimburse any costs reasonably incurred by Vendor in the course of providing, cooperation, information, or assistance requested by Customer pursuant to Sections 6, 9, and 10.1 of this DPA, beyond providing self service features included as part of the Service.

12. DEIDENTIFIED, ANONYMIZED, OR AGGREGATED DATA

12.1. To the extent Vendor processes and/or generates any Deidentified Data, Vendor shall (i) take reasonable measures to ensure that such data cannot be associated with a natural person, and (ii) publicly commit to maintaining and using Deidentified Data only in a de-identified fashion and without attempting to re-identify such data.

12.2. If Vendor’s creation and/or use of aggregated, anonymized, or deidentified personal information is subject to Applicable Data Protection Laws, then Vendor’s creation and/or use of such data, including but not limited to Deidentified Data, shall be permitted only to the extent such data constitutes “aggregate consumer information” or has been “deidentified” (as such terms are defined under the Applicable Data Protection Laws).

13. LIABILITY

The total aggregate liability of either Party towards the other Party, howsoever arising, under or in connection with this DPA, the Agreement, and the SCCs (if and as they apply) will under no circumstances exceed any limitations or caps on, and shall be subject to any exclusions of, liability and loss agreed by the Parties in the Agreement; provided that, nothing in this Section 13 will affect any person’s liability to Data Subjects under the third-party beneficiary provisions of the SCCs (if and as they apply).

14. CHANGE IN LAWS

Vendor may on notice vary this DPA to the extent that (acting reasonably) it considers necessary to address the requirements of Applicable Data Protection Laws from time to time, including by varying or replacing the SCCs in the manner described in Paragraphs 1.1 and 1.2 of Annex 2 (European Annex).

15. INCORPORATION AND PRECEDENCE

15.1. This DPA shall be incorporated into and form part of the Agreement with effect from the Addendum Effective Date.

15.2. In the event of any conflict or inconsistency between:

1. this DPA and the Agreement, this DPA shall prevail; or
2. any SCCs entered into pursuant to Paragraph 2 of Annex 2 (European Annex) and this DPA and/or the Agreement, the SCCs shall prevail in respect of the Restricted Transfer to which they apply.

16. Protected Health Information

16.1. If Customer and Vendor have entered into a Business Associate Agreement (“BAA”) regarding the Processing of protected health information (“PHI”), then in the event of any conflict between this DPA and the BAA regarding obligations for Customer Personal Data that is also PHI, the terms of the BAA shall apply to the Customer Personal Data that is also PHI. For the avoidance of doubt, this DPA does not apply to PHI.

Annex 1

Data Processing Details

VENDOR / ‘DATA IMPORTER’ DETAILS

DETAILS OF PROCESSING

Annex 2

European Annex

1. DATA PROTECTION IMPACT ASSESSMENT AND PRIOR CONSULTATION

1.1. Taking into account the nature of the Processing of Customer Personal Data by Vendor and the information available to Vendor, Vendor shall provide reasonable assistance to Customer, at Customer’s cost, with any data protection impact assessments and prior consultations with Supervisory Authorities which Customer reasonably considers to be required of it by Article 35 or Article 36 of the GDPR, in each case solely in relation to Processing of Customer Personal Data by Vendor.

2. RESTRICTED TRANSFERS

EEA Restricted Transfers

2.1. To the extent that any Processing of Customer Personal Data under this DPA involves an EEA Restricted Transfer from Customer to Vendor, the Parties shall comply with their respective obligations set out in the SCCs, which are hereby deemed to be:

1. populated in accordance with Part 1 of Attachment 1 to this Annex 2 (European Annex); and
2. entered into by the Parties and incorporated by reference into this DPA.

UK Restricted Transfers

2.2. To the extent that any Processing of Customer Personal Data under this DPA involves a UK Restricted Transfer from Customer to Vendor, the Parties shall comply with their respective obligations set out in the SCCs, which are hereby deemed to be:

1. varied to address the requirements of the UK GDPR in accordance with the UK Transfer Addendum and populated in accordance with Part 2 of Attachment 1 to this Annex 2 (European Annex); and
2. entered into by the Parties and incorporated by reference into this DPA.

Adoption of new transfer mechanism

2.3. Vendor may on notice vary this DPA and replace the relevant SCCs with:

1. any new form of the relevant SCCs or any replacement therefor prepared and populated accordingly (e.g., standard data protection clauses adopted by the European Commission for use specifically in respect of transfers to data importers subject to Article 3(2) of the EU GDPR); or
2. another transfer mechanism, other than the SCCs, that enables the lawful transfer of Customer Personal Data by Customer to Vendor under this DPA in compliance with Chapter V of the GDPR.

Provision of full-form SCCs

2.4. In respect of any given Restricted Transfer, if requested of Customer by a Supervisory Authority, Data Subject or further Controller (where applicable) – on specific written request (made to the contact details set out in Annex 1 (Data Processing Details); accompanied by suitable supporting evidence of the relevant request), Vendor shall provide Customer with an executed version of the relevant set(s) of SCCs responsive to the request made of Customer (amended and populated in accordance with Attachment 1 to this Annex 2 (European Annex) in respect of the relevant Restricted Transfer) for countersignature by Customer, onward provision to the relevant requestor and/or storage to evidence Customer’s compliance with Applicable Data Protection Laws.

3. OPERATIONAL CLARIFICATIONS

3.1. When complying with its transparency obligations under Clause 8.3 of the SCCs, Customer agrees that it shall not provide or otherwise make available, and shall take all appropriate steps to protect Vendor’s and its licensors’ trade secrets, business secrets, confidential information and/or other commercially sensitive information.

3.2. Where applicable, for the purposes of Clause 10(a) of Module Three of the SCCs, Customer acknowledges and agrees that there are no circumstances in which it would be appropriate for Vendor to notify any third-party controller of any Data Subject Request and that any such notification shall be the sole responsibility of Customer.

3.3. For the purposes of Clause 15.1(a) of the SCCs, except to the extent prohibited by applicable law and/or the relevant public authority, as between the Parties, Customer agrees that it shall be solely responsible for making any notifications to relevant Data Subject(s) if and as required.

3.4. The terms and conditions of Section 8 of this DPA apply in relation to Vendor’s appointment and use of Sub-processors under the SCCs. Any approval by Customer of Vendor’s appointment of a Sub-processor that is given expressly or deemed given pursuant to Section 8 constitutes Customer’s documented instructions to effect disclosures and onward transfers to any relevant Sub-processors if and as required under Clause 8.8 of the SCCs.

3.5. The audits described in Clauses 8.9(c) and 8.9(d) of the SCCs shall be subject to any relevant terms and conditions detailed in Section 9 of this DPA.

3.6. Certification of deletion of Customer Personal Data as described in Clauses 8.5 and 16(d) of the SCCs shall be provided only upon Customer’s written request.

TO EUROPEAN ANNEX

POPULATION OF SCCs

Notes:

• In the context of any EEA Restricted Transfer, the SCCs populated in accordance with Part 1 of this Attachment 1 are incorporated by reference into and form an effective part of the DPA (if and where applicable in accordance with Paragraph 2.1 of Annex 2 (European Annex) to the DPA).
• In the context of any UK Restricted Transfer, the SCCs as varied by the UK Transfer Addendum and populated in accordance with Part 2 of this Attachment 1 are incorporated by reference into and form an effective part of the DPA (if and where applicable in accordance with Paragraph 2.2 of Annex 2 (European Annex) to the DPA).

PART 1: POPULATION OF THE SCCs

1. SIGNATURE OF THE SCCs:

Where the SCCs apply in accordance with Paragraph 2.1 of Annex 2 (European Annex) to the DPA, each of the Parties is hereby deemed to have signed the SCCs at the relevant signature block in Annex I to the Appendix to the SCCs.

2. MODULES

The following modules of the SCCs apply in the manner set out below (having regard to the role(s) of Customer set out in Attachment 1 to Annex 2 (European Annex) to the DPA):

1. Module Two of the SCCs applies to any EEA Restricted Transfer involving Processing of Customer Personal Data in respect of which Customer is a Controller in its own right; and/or
2. Module Three of the SCCs applies to any EEA Restricted Transfer involving Processing of Customer Personal Data in respect of which Customer is a Processor.

3. POPULATION OF THE BODY OF THE SCCs

3.1. For each Module of the SCCs, the following applies as and where applicable to that Module and the Clauses thereof:

1. The optional ‘Docking Clause’ in Clause 7 is not used and the body of that Clause 7 is left intentionally blank.
2. In Clause 9:
   1. OPTION 2: GENERAL WRITTEN AUTHORISATION applies, and the minimum time period for advance notice of the addition or replacement of Sub-Processors shall be the advance notice period set out in Section 8.4 of the DPA; and
   2. OPTION 1: SPECIFIC PRIOR AUTHORISATION is not used and that optional language is deleted; as is, therefore, Annex III to the Appendix to the SCCs.
3. In Clause 11, the optional language is not used and is deleted.
4. In Clause 13, all square brackets are removed and all text therein is retained.
5. In Clause 17: OPTION 1 applies, and the Parties agree that the SCCs shall be governed by the law of Ireland in relation to any EEA Restricted Transfer; and OPTION 2 is not used and that optional language is deleted.
6. For the purposes of Clause 18, the Parties agree that any dispute arising from the SCCs in relation to any EEA Restricted Transfer shall be resolved by the courts of Ireland, and Clause 18(b) is populated accordingly.

3.2. In this Paragraph 3, references to “Clauses” are references to the Clauses of the SCCs.

4. POPULATION OF ANNEXES TO THE APPENDIX TO THE SCCs

4.1. Annex I to the Appendix to the SCCs is populated with the corresponding information detailed in Annex 1 (Data Processing Details) to the DPA, with: Customer being ‘data exporter’; and Vendor being ‘data importer’.

4.2. Part C of Annex I to the Appendix to the SCCs is populated as below:

4.3. Annex II to the Appendix to the SCCs is populated as below:

PART 2: UK RESTRICTED TRANSFERS

1. UK TRANSFER ADDENDUM

1.1. Where relevant in accordance with Paragraph 2.2 of Annex 2 (European Annex) to the DPA, the SCCs also apply in the context of UK Restricted Transfers as varied by the UK Transfer Addendum in the manner described below –

1. Part 1 to the UK Transfer Addendum. The Parties agree:
   1. Tables 1, 2 and 3 to the UK Transfer Addendum are deemed populated with the corresponding details set out in Annex 1 (Data Processing Details) to the DPA and the foregoing provisions of this Attachment 1 to Annex 2 (European Annex) (subject to the variations effected by the UK Mandatory Clauses described in (b) below); and
   2. Table 4 to the UK Transfer Addendum is completed by the box labelled ‘Data Importer’ being deemed to have been ticked.
2. Part 2 to the UK Transfer Addendum. The Parties agree to be bound by the UK Mandatory Clauses of the UK Transfer Addendum.

1.2. As permitted by Section 17 of the UK Mandatory Clauses, the Parties agree to the presentation of the information required by ‘Part 1: Tables’ of the UK Transfer Addendum in the manner set out in Paragraph 1.1 of this Part 2; provided that the Parties further agree that nothing in the manner of that presentation shall operate or be construed so as to reduce the Appropriate Safeguards (as defined in Section 3 of the UK Mandatory Clauses).

1.3. In relation to any UK Restricted Transfer to which they apply, where the context permits and requires, any reference in the DPA to the SCCs, shall be read as a reference to those SCCs as varied in the manner set out in Paragraph 1.3 of this Part 2.

Annex 3

California Annex

1. In this Annex, the terms “business,” “business purpose,” “commercial purpose,” “consumer,” “sell,” “share,” and “service provider” shall have the respective meanings given thereto in the CCPA; and “personal information” shall mean Customer Personal Data that constitutes “personal information” as defined in and that is subject to the CCPA.
2. The business purposes and services for which Vendor is Processing personal information are for Vendor to provide the services to and on behalf of Customer as set forth in the Agreement, as described in more detail in Annex 1.
3. It is the Parties’ intent that with respect to any personal information, Vendor is a service provider. Vendor (a) acknowledges that personal information is disclosed by Customer only for limited and specific purposes described in the Agreement; (b) shall comply with applicable obligations under the CCPA and shall provide the same level of privacy protection to personal information as is required by the CCPA; (c) agrees that Customer has the right to take reasonable and appropriate steps under Section 9 of this DPA to help ensure that Vendor’s use of personal information is consistent with Customer’s obligations under the CCPA; (d) shall notify Customer in writing of any determination made by Vendor that it can no longer meet its obligations under the CCPA; and (e) agrees that Customer has the right, upon notice, including pursuant to the preceding clause, to take reasonable and appropriate steps to stop and remediate unauthorized use of personal information.
4. Vendor shall not (a) sell or share any personal information; (b) retain, use or disclose any personal information for any purpose other than for the business purposes specified in the Agreement, including retaining, using, or disclosing the personal information for a commercial purpose other than the business purpose specified in the Agreement, or as otherwise permitted by CCPA; (c) retain, use or disclose the personal information outside of the direct business relationship between Vendor and Customer; or (d) combine personal information received pursuant to the Agreement with personal information (i) received from or on behalf of another person, or (ii) collected from Vendor’s own interaction with any consumer to whom such personal information pertains.
5. Vendor shall implement reasonable security procedures and practices appropriate to the nature of the personal information received from, or on behalf of, Customer, in accordance with Section 5 of the DPA.
6. When Vendor engages any Sub-processor, Vendor shall notify Customer of such Sub-processor engagements in accordance with Section 8 of the DPA.
7. Obligations under this Annex that are neither required to be imposed on Vendor for Vendor to qualify as a service provider under the CCPA nor for the Parties to comply with their obligations under the CCPA in relation to the required terms of contracts, in each case, before the CPRA becomes operative on January 1, 2023, shall apply to Vendor only on and after January 1, 2023.

Annex 4

Security Measures

As from the Addendum Effective Date, Vendor will implement and maintain the Security Measures as set out in this Annex 4.

1. Organizational management and dedicated staff responsible for the development, implementation and maintenance of Vendor’s information security program.
2. Audit and risk assessment procedures for the purposes of periodic review and assessment of risks to Vendor’s organization, monitoring and maintaining compliance with Vendor’s policies and procedures, and reporting the condition of its information security and compliance to internal senior management.
3. Data security controls which include at a minimum logical segregation of data, restricted (e.g. role-based) access and monitoring, and utilization of commercially available and industry standard encryption technologies for Customer Personal Data.
4. Logical access controls designed to manage electronic access to data and system functionality based on authority levels and job functions.
5. Password controls designed to manage and control password strength, expiration and usage.
6. System audit or event logging and related monitoring procedures to proactively record user access and system activity.
7. Physical and environmental security of data centers, server room facilities and other areas containing Customer Personal Data designed to protect information assets from unauthorized physical access or damage.
8. Operational procedures and controls to provide for configuration, monitoring and maintenance of technology and information systems, including secure disposal of systems and media to render all information or data contained therein as undecipherable or unrecoverable prior to final disposal or release from Vendor’s possession.
9. Change management procedures and tracking mechanisms designed to test, approve and monitor all material changes to Vendor’s technology and information assets.
10. Incident management procedures designed to allow Vendor to investigate, respond to, mitigate and notify of events related to Vendor’s technology and information assets.
11. Network security controls that provide for the use of enterprise firewalls and intrusion detection systems designed to protect systems from intrusion and limit the scope of any successful attack.
12. Vulnerability assessment and threat protection technologies and scheduled monitoring procedures designed to identify, assess, mitigate and protect against identified security threats, viruses and other malicious code.
13. Business resiliency/continuity and disaster recovery procedures designed to maintain service and/or recovery from foreseeable emergency situations or disasters.
14. All AI sub-processors are bound to no-train, no-retain obligations equivalent to those in the DPA.

Vendor may update the Security Measures from time to time in accordance with Section 5.2 of the DPA.

Annex 5

Brazil Annex

1. With respect to Customer Personal Data Processed by Vendor in accordance with Customer's instructions under Section 3 of this DPA, the obligations of Customer under Section 3 shall extend to full compliance with the LGPD and other applicable Brazilian data protection legislation. Accordingly, Customer shall not only provide transparency notices to affected Data Subjects, but also ensure that all Customer Personal Data shared with Vendor has been collected from lawful sources, that the processing of these Customer Personal Data carried out by Vendor has a valid legal basis, irrespective of whether such legal basis requires the Data Subject's consent, and that other LGPD requirements are complied with.
2. Where any sharing, transmission or granting of access to Customer Personal Data between Customer and Vendor constitutes an international transfer of Customer Personal Data subject to the LGPD, the Parties shall comply with the rules of the applicable Brazilian data protection legislation, in particular Resolution CD/ANPD No. 19/2024. Among other requirements, the Parties shall define and ensure that the transfer is supported by a valid transfer mechanism, and unless the Parties have agreed to an alternative valid transfer mechanism, the standard contractual clauses set out in the Annex II to the Resolution, included as Schedule 1 to Annex 5, shall apply to all Brazilian Restricted Transfers. Onward international transfers carried out between Vendor and its contracted third parties shall be authorized by Customer, pursuant to Section 8 of this DPA and provided that the Resolution remains observed.

Schedule I to Annex 5 (Brazilian Standard Contractual Clauses)

This Schedule I reproduces, in full and without alteration to their operative text, the standard contractual clauses (cláusulas-padrão contratuais) approved by the ANPD pursuant to Resolução CD/ANPD nº 19, of 23 August 2024 (as amended or replaced, the “LGPD SCCs”), for use where a Brazilian Restricted Transfer relies on standard contractual clauses as its transfer mechanism under Article 33, item II(b) of the LGPD. Any capitalized term used but not defined in this Schedule I has the meaning given to it in the LGPD SCCs.

Section I – General Information

Clause 1. Identification of the Parties

1.1. By this contractual instrument, the Exporter and the Importer (together, the Parties), identified below, adopt the standard contractual clauses (the Clauses) approved by the ANPD to govern the International Data Transfer described in Clause 2, in accordance with the provisions of Brazilian law (Legislação Nacional).

Exporter: Customer.
Importer: Roam HQ Inc.

Clause 2. Subject Matter

2.1. These Clauses apply to International Data Transfers from the Exporter to the Importer described below: main purposes of the transfer, categories of personal data transferred, and data retention period are included in Annex 1 (Data Processing Details) to this DPA.

Clause 3. Onward Transfers

3.1. the Importer may carry out an Onward Transfer under the conditions described in an executed supplement to this Schedule 1, subject to Clause 18.

Clause 4. Responsibilities of the Parties

4.1. Without prejudice to the duty of mutual assistance and the Parties' general obligations, the Party designated below (the Designated Party), acting as Controller, is responsible for: (a) publishing the transparency document required by Clause 14; (b) responding to Data Subject requests under Clause 15; and (c) making the security incident notification required by Clause 16, in each case as designated between Exporter and Importer.

1. Responsible for publishing the document referred to in Clause 14: Exporter
2. Responsible for responding to data subject requests as provided in Clause 15: Exporter
3. Responsible for reporting security incidents as provided in Clause 16: Exporter

4.2. For the purposes of these Clauses, if the Designated Party pursuant to item 4.1. is the Processor, the Controller remains responsible for:

1. compliance with the obligations provided in CLAUSES 14, 15 and 16 and other provisions established in the National Legislation, especially in case of omission or non-compliance with the obligations by the Designated Party;
2. compliance with ANPD’s determinations; and
3. guaranteeing the Data Subjects’ rights and repairing damages caused, subject to the provisions of Clause 17.

4.3. In the event of being deemed a Controlling Party as referred to in item 4.2, the Exporter shall be responsible for complying with the obligations set out in Clauses 14, 15 and 16.

4.4. With the exception of the provisions of items 4.2 and 4.3, the provisions of Clauses 14, 15 and 16 shall not apply to the Parties as Processors.

4.5. The Parties shall, in any event, provide all the information at their disposal that proves necessary for the Third-Party Controller to comply with ANPD’s determinations and to adequately fulfill the obligations provided for in the National Legislation relating to transparency, compliance with the rights of data subjects and the reporting of security incidents to ANPD.

4.6. The Parties shall promote mutual assistance in order to meet the requests of the Data Subject.

4.7. In the event of receiving a request from a Data Subject, the Party shall:

1. respond to the request, when it has the necessary information;
2. inform the Data Subject of the service channel provided by the Third-Party Controller; or
3. forward the request to the Third-Party Controller as soon as possible, to enable a response within the period provided for in the National Legislation.

4.8. The Parties must keep a record of security incidents involving personal data, in accordance with national legislation.

Section II – Mandatory Clauses

The following Clauses 5 to 24 are adopted in full and without any alteration to their text, as required for the validity of the International Data Transfer:

Clause 5. Purpose. 5.1. These Clauses serve as a mechanism enabling the secure international flow of personal data, establish minimum guarantees and valid conditions for carrying out an International Data Transfer, and are intended to ensure the adoption of appropriate safeguards for compliance with the principles, Data Subject rights and data protection regime under Brazilian law.

Clause 6. Definitions. 6.1. For the purposes of these Clauses, the definitions in Article 5 of Law No. 13,709/2018 and Article 3 of the International Data Transfer Regulation apply, without prejudice to other regulatory acts issued by the ANPD, together with the additional defined terms set out in Anexo II to Resolução CD/ANPD nº 19/2024 (including Agents of Processing, ANPD, Clauses, Related Contract, Controller, Personal Data, Sensitive Personal Data, Elimination, Exporter, Importer, National Legislation, Arbitration Law, Security Measures, Research Body, Operator, Designated Party, Parties, Access Request, Subcontracted Party, Third Party Controller, Data Subject, Transfer, International Data Transfer, and Onward Transfer).

Clause 7. Applicable Law and ANPD Oversight. 7.1. The International Data Transfer governed by these Clauses is subject to Brazilian law and to oversight by the ANPD, including its power to apply preventive measures and administrative sanctions to either Party, and to limit, suspend or prohibit international transfers arising from these Clauses or a Related Contract.

Clause 8. Interpretation. 8.1. These Clauses shall always be interpreted in the manner most favorable to the Data Subject and in accordance with Brazilian law; in case of doubt as to the meaning of a term, the meaning most consistent with Brazilian law applies; no provision of these Clauses, a Related Contract, or Section IV, may be interpreted so as to limit or exclude either Party's liability for obligations under Brazilian law; and Sections I and II prevail in case of conflict with additional clauses under Sections III and IV or a Related Contract.

Clause 9. Accession by Third Parties. 9.1–9.2. By mutual agreement, another Agent of Processing may accede to these Clauses as Exporter or Importer by executing a written instrument forming part of this Schedule I, assuming the same rights and obligations as the original Parties in the corresponding role.

Clause 10. General Obligations of the Parties. 10.1. The Parties undertake to adopt, and where necessary demonstrate, effective measures capable of proving compliance with these Clauses and Brazilian law, including to: (a) use the Personal Data only for the specific purposes described in Clause 2; (b) ensure the compatibility of processing with the purposes notified to the Data Subject; (c) limit processing to what is necessary for those purposes; (d) guarantee Data Subjects clear and accessible information, facilitated and free consultation, and accuracy of their Personal Data; (e) adopt security measures appropriate to the risks of the transfer; (f) not process Personal Data for unlawful discriminatory purposes; (g) ensure that any person acting under a Party's authority, including sub-processors, processes data only in accordance with instructions and these Clauses; and (h) keep records of processing operations and provide them to the ANPD on request.

Clause 11. Sensitive Personal Data. 11.1. Where the International Data Transfer involves sensitive personal data, the Parties shall apply additional safeguards, including security measures proportionate to the risks, as described in Section III.

Clause 12. Personal Data of Children and Adolescents. 12.1. Where the International Data Transfer involves personal data of children and adolescents, the Parties shall apply additional safeguards to ensure processing occurs in their best interest, consistent with Brazilian law and applicable international instruments.

Clause 13. Lawful Use of Data. 13.1. The Exporter warrants that the Personal Data was collected, processed and transferred to the Importer in accordance with Brazilian law.

Clause 14. Transparency. 14.1–14.4. The Designated Party shall publish on its website accessible information, in plain language, about the International Data Transfer, including its form, duration and specific purpose, destination country, the Designated Party's contact details, data sharing, agent responsibilities, Data Subject rights and how to exercise them (including the right to petition the ANPD), and details of any Onward Transfer; a copy of these Clauses shall be made available free of charge to a Data Subject on request; and all information provided to Data Subjects under these Clauses shall be in Portuguese.

Clause 15. Data Subject Rights. 15.1–15.6. The Data Subject has the right to obtain from the Designated Party, on request and in accordance with Brazilian law: confirmation of processing; access; correction of incomplete, inaccurate or outdated data; anonymization, blocking or deletion of unnecessary, excessive or unlawfully processed data; data portability; deletion of data processed with consent (subject to Clause 20); information on entities with which data has been shared; information on the consequences of withholding consent; withdrawal of consent; review of decisions based solely on automated processing; and information on the criteria and procedures used for automated decisions. The Data Subject may object to processing based on a legal ground other than consent in case of non-compliance with these Clauses or Brazilian law. Requests under this Clause and item 14.3 shall be answered within 15 days of the request, unless a different period is established by specific ANPD regulation. Where a request is directed to a Party not designated as responsible, that Party shall inform the Data Subject of the correct contact channel or forward the request promptly to the Designated Party.

Clause 16. Security Incident Notification. 16.1–16.2. The Designated Party shall notify the ANPD and affected Data Subjects within 3 (three) business days of becoming aware of a security incident that may create relevant risk or harm to Data Subjects, in accordance with Brazilian law. The Importer shall maintain a register of security incidents in accordance with Brazilian law.

Clause 17. Liability and Compensation for Damages. 17.1–17.9. A Party that causes patrimonial, moral, individual or collective harm through processing in violation of these Clauses or Brazilian law is obliged to remedy it; the Data Subject may claim compensation from either Party for a violation of these Clauses; an Operator is jointly and severally liable for harm caused by processing where it fails to comply with these Clauses or the Controller's lawful instructions; Controllers directly involved in processing that causes harm are jointly and severally liable; no liability arises where a Party proves it did not carry out the processing attributed to it, that there was no violation, or that the harm resulted exclusively from the fault of the Data Subject or an unrelated third party; a court may reverse the burden of proof in the Data Subject's favor in accordance with Brazilian law; collective redress actions may be brought under applicable law; and a Party that compensates the Data Subject has a right of recourse against other responsible parties in proportion to their participation.

Clause 18. Safeguards for Onward Transfer. 18.1–18.3. The Importer may only make an Onward Transfer if expressly authorized under Clause 3, and must in any case ensure the purpose of the Onward Transfer is compatible with Clause 2, guarantee by written contract that the recipient observes the safeguards in these Clauses, and remain responsible for irregularities committed by that recipient; an Onward Transfer may also be made on the basis of another valid transfer mechanism under Brazilian law, independent of the Clause 3 authorization.

Clause 19. Notification of Access Requests. 19.1–19.3. The Importer shall notify the Exporter and the Data Subject of any Access Request relating to the Personal Data, unless prohibited by the law of the country where the data is processed; the Importer shall take appropriate legal measures, including judicial action, to challenge an unlawful Access Request or an unlawful prohibition on notification; and the Importer shall maintain a register of Access Requests, including date, requester, purpose, data type, number of requests and legal measures taken, for the ANPD and the Exporter.

Clause 20. Termination of Processing and Data Deletion. 20.1–20.2. The Parties shall delete the Personal Data after the processing ends, subject to retention only for: compliance with a legal or regulatory obligation of the Controller; research by a Research Body, with anonymization where possible; transfer to a third party in compliance with these Clauses and Brazilian law; or the Controller's exclusive use, anonymized and inaccessible to third parties. Processing is deemed to have ended when the purpose is achieved, the data is no longer necessary, the processing period ends, a Data Subject request is fulfilled, or the ANPD so determines due to a violation.

Clause 21. Data Processing Security. 21.1–21.3. The Parties shall adopt security measures protecting the Personal Data, including after processing ends, as detailed in Section III, and shall periodically evaluate and review those measures to maintain an adequate level of security.

Clause 22. Law of the Recipient Country. 22.1–22.2. The Importer declares that it has not identified any law or administrative practice of the recipient country that would prevent it from complying with its obligations under these Clauses, and shall immediately notify the Exporter of any subsequent change affecting that position.

Clause 23. Non-Compliance by the Importer. 23.1–23.2. Where the Importer violates or is unable to comply with the safeguards in these Clauses, the Exporter shall be notified immediately (subject to Clause 19.1) and shall take appropriate measures, which may include suspending the transfer, requesting return, onward transfer or deletion of the data, or terminating the contract.

Clause 24. Choice of Forum and Jurisdiction. 24.1–24.3. Brazilian law applies to these Clauses and any dispute between the Parties shall be resolved before the competent courts of Brazil, subject to any forum elected by the Parties in Section IV; Data Subjects may bring proceedings against the Exporter or the Importer before the competent Brazilian courts, including those of their place of residence; and the Parties may agree to resolve disputes by arbitration seated in Brazil under Law No. 9,307/1996.

Section III – Security Measures

The security measures applicable to the International Data Transfer governed by this Schedule I, including governance and oversight of internal processes and technical and administrative security measures for collection, transmission and storage of data, are those set out in Annex 4 (Security Measures) of this DPA, which the Parties adopt for this purpose.

Section IV – Additional Clauses and Annexes

This Section IV may optionally record additional commercial terms, termination, term and choice-of-forum-in-Brazil provisions agreed by the Parties, provided that no such term excludes, modifies or contradicts, directly or indirectly, the Clauses in Sections I, II or III above. No additional clause has been agreed as of the Addendum Effective Date.