Data Processing Addendum (DPA)

Last Modified Date: October 17, 2023

This Data Processing Addendum, including all of its Annexes, (“Addendum”) amends and forms part of the Master Agreement and by and between the Parties that reference this Addendum which respectively govern the technical support services, professional services, customization services, employee reward and engagement services, and/or software-as-a-service solutions provided by Terryberry to Customer (“Services”). In the course of providing the Services to Customer pursuant to the Master Agreement, Terryberry may process personal data on behalf of Customer. This Addendum sets out the additional terms, requirements and conditions on which Terryberry will process personal data as far as such processing relates to the performance of the Services. This Addendum, together with all appendices, annexes, exhibits, attachments, and amendments hereto, reflects the Parties’ agreement with regard to Terryberry’s Processing of Customer Personal Data in connection with providing Terryberry Services described in the Master Agreement. In the event of a conflict, the terms and conditions of this Addendum will prevail. Capitalized terms not otherwise defined herein shall have the meaning given to them in the Master Agreement or in applicable Data Protection Legislation.

1. ROLE OF THE PARTIES.

This Addendum shall apply where Customer acts as a controller and Terryberry as a processor, or where Customer acts as a processor and Terryberry as a sub-processor.

2. INDEPENDENT PROCESSING.

Terryberry may also process personal data in connection with the Order in Terryberry's own capacity as a data controller (where Terryberry will determine the purposes and means of the processing, including for example when processing payment for rewards). The provisions of this Addendum shall not apply to such processing where Terryberry is the data controller, but Terryberry shall undertake such processing in accordance with Terryberry's legal obligations to data subjects under the Data Protection Legislation.

3. COMPLIANCE WITH DATA PROTECTION LEGISLATION.

With respect to the processing of the Customer Personal Data in connection with the licensing of the Site and the provision and receipt of the benefit of the other Terryberry Services pursuant to the Order and this Addendum, both Parties will comply with all applicable requirements of the Data Protection Legislation and the provisions of this Addendum.

4. PROCESSING OF PERSONAL DATA.

4.1. Details of Processing.

Annex I sets out the scope, nature and purpose of processing by Terryberry, the duration of the processing and the types of personal data and categories of data subject.

4.2. Instructions.

Customer appoints Terryberry to process such personal data on behalf of Customer, and in accordance with Customer’s documented instructions, as otherwise necessary to provide the Services, or as otherwise agreed in writing by the Parties. The scope of such instructions is initially defined by the Master Agreement.

5. CUSTOMER RESPONSIBILITIES.

5.1. Appropriate Consents.

At all times, Customer will ensure that it has all necessary appropriate consents and notices in place to enable lawful transfer of the personal data to Terryberry for the duration and purposes of this Addendum. If at any time Customer has reason to believe that the processing of any Customer Personal Data under this Addendum is in breach of Data Protection Legislation, Customer shall immediately notify Terryberry, together with an explanation of the concern. Prior to sharing any Customer Personal Data with Terryberry, Customer shall:

a. identify the lawful basis on which the Parties can rely under Data Protection Legislation to process such Customer Personal Data. Unless the lawful basis Customer wishes to rely on is performance of a contract or the data subject's consent, Customer shall inform Terryberry of the lawful basis for processing such Customer Personal Data (prior to sharing such personal data with Terryberry) and if the lawful basis for processing changes, Customer shall notify Terryberry as soon as practicable, but in any event no later than fourteen (14) days after such change occurs;

b. provide the following information to data subjects: "The technology we use to provide you with the reward scheme is licensed to us and hosted by Terryberry Company LLC ("Terryberry"). Terryberry will have access to your personal data as a result. Such data will be processed by Terryberry in accordance with a Data Processing Addendum. If you have any queries regarding the use of your personal data, please contact Privacy Officer at [email protected]; together with all other necessary fair processing information required under Data Protection Legislation about the processing of the Customer Personal Data; and

c. obtain the data subject’s consent to processing their personal data (where the lawful basis Customer is relying on to process the Customer Personal Data is consent).

5.2. Lawful Instructions.

Customer shall ensure at all times that Customer's instructions to Terryberry for the processing of the Customer Personal Data under this Addendum comply with Data Protection Legislation. Customer shall not cause Terryberry to violate any applicable laws in its processing of the personal data in accordance with Customer’s instructions.

5.3. Correspondence with Data Subjects.

Customer shall be responsible for the provision of the corresponding fair processing information to relevant data subjects and for obtaining any consents that may be required (in each case to the extent necessary in order to comply with Data Protection Legislation) from that data subject. Customer shall ensure that such fair processing notices are accurate and complete, and that any consents are sufficient in order for Terryberry to lawfully process the Customer Personal Data in the manner set out in this Addendum.

5.4. Third Party Transfer Required by Customer.

If Customer requires Terryberry to transfer any Customer Personal Data to a third-party provider engaged by Customer, Customer shall be solely responsible for identifying the lawful basis under the Data Protection Legislation on which the Parties can rely under the Data Protection Legislation to transfer such Customer Personal Data to the relevant third party provider (and Customer shall notify Terryberry of the same). A written data processing addendum must be in place between Customer and such provider. Customer acknowledges and agrees that Terryberry has no control over and shall have no liability in respect of how any personal data is processed by such third party provider engaged by Customer.

5.5. Third Party Services Integration.

If Customer has requested integration of the services provided by Terryberry with any third-party applications, including social media platforms, it shall be Customer’s sole responsibility to ensure such third-party integration complies with Data Protection Legislation. Such third parties shall either be data controllers or data processors on behalf of Customer and shall have no direct relationship with Terryberry. Terryberry shall not be responsible or liable for the way in which other data controllers and/or Customer’s other data processors process the Customer Personal Data.

6. TERRYBERRY'S OBLIGATIONS WHEN ACTING AS A DATA PROCESSOR

6.1. Processing.

In respect of the Customer Personal Data processed by Terryberry on behalf of Customer, Terryberry shall:

a. only process the Customer Personal Data to the extent and in such a manner, as is necessary to provide the services in accordance with the terms of the Order and this Addendum, and only on written instructions issued by Customer from time to time (provided that such instructions are within the scope of Terryberry's obligations under this Addendum), unless otherwise required by law, regulation, court of competent jurisdiction or any other governmental or regulatory body;

b. not collect, retain, use, process or disclose the Customer Personal Data (a) for any purpose other than for the specific purpose of providing the Services specified in the Order to the Customer or (b) outside of the direct business relationship between Terryberry and the Customer;

c. not sell any Customer Personal Data;

d. comply with any request from Customer requiring Terryberry to amend, transfer or delete the Customer Personal Data;

e. inform Customer if, in its opinion, (i) an instruction infringes any Applicable Law, including any Data Protection Legislation, (ii) any Applicable Law to which Terryberry is subject requires Terryberry to process Customer Personal Data in a manner contrary to the Customer’s instructions or beyond the purpose of fulfilling its obligations under the SOW, or (iii) if it cannot comply with Customer’s documented instructions for any other reason. In any such case, Terryberry shall inform the Customer in advance of any relevant processing of the affected Customer Personal Data, unless the relevant Applicable Law prohibits this on important grounds of public interest. The parties shall work together to find a reasonable alternative solution. If Terryberry notifies Customer that neither the instruction nor the alternative is feasible, then Customer may, in its sole discretion, either immediately suspend transfer of Customer Personal Data to Terryberry or terminate part or all of the SOW without penalty or payment of termination charges in accordance with the Master Agreement. Any previously accrued rights and obligations will survive such termination. Customer acknowledges that certain specific instructions may result in additional fees payable by Customer to Terryberry for carrying out those instructions.

f. maintain the confidentiality of all Customer Personal Data and ensure that personnel who have access to and/or process the Customer Personal Data are obliged to keep the same confidential;

g. process the Customer Personal Data only to the extent, and in such manner, as is necessary in order to comply with its obligations to Customer or as is required by law or any regulatory body including but not limited to the UK Information Commissioner’s Office (“ICO”);

h. not transfer the Customer Personal Data outside of the EEA or UK without complying with the provisions of Section 8 below and the Data Protection Legislation in respect of such transfer, save that if Customer requires Terryberry to transfer any Customer Personal Data outside the EEA or UK pursuant to Customer's instructions, it shall be Customer's responsibility to ensure that any such transfer complies with the provisions of the Data Protection Legislation and to notify Terryberry of any specific instructions or restrictions in respect of the same;

i. At the written direction of Customer, delete or return personal data and copies thereof to Customer following termination of the Master Agreement unless required by applicable law (including any Data Protection Legislation) to store the personal data. In the event that Customer has not provided such written direction, the personal data will be deleted as set out in the Master Agreement.

6.2. Reasonable Assistance.

In respect of the Customer Personal Data processed by Terryberry on behalf of Customer, Terryberry shall:

a. promptly notify Customer if it receives: (1) a request from a data subject to have access to that person’s personal data; or (2) a complaint or request relating to the processing of the personal data or to either party’s compliance with the Data Protection Legislation;

b. upon Customer’s request and insofar as is reasonably possible, provide commercially reasonable assistance, at Customer’s cost, to facilitate such a data subject request;

c. reasonably assist Customer, at Customer's cost, in ensuring compliance with Customer's obligations under the Data Protection Legislation with respect to consultations with the ICO;

d. ensure that Terryberry does not respond to that request except on the documented instructions of Customer or as required by Applicable Laws to which Terryberry is subject, in which case Terryberry shall to the extent permitted by Applicable Laws inform Customer of that legal requirement before Terryberry responds to the request;

e. provide Customer with reasonable cooperation and assistance, at Customer's cost, as may be required to fulfil Customer's obligation under the Data Protection Legislation to carry out a data protection impact assessment related to Customer's use of the Site, to the extent that Customer does not otherwise have access to the relevant information and to the extent that such information is available to Terryberry;

6.3. Security Measures.

In respect of the Customer Personal Data processed by Terryberry on behalf of Customer, Terryberry shall:

a. without limiting Terryberry’s security-related obligations under an Order or SOW, Terryberry shall at all times have implemented and maintain a comprehensive information security program that (i) complies with all applicable Data Protection Legislation, and (ii) contains reasonable and appropriate administrative, operational, technical, physical and organizational measures that are designed to preserve and protect the security, integrity and confidentiality of Customer Personal Data and protect Customer Personal Data against Customer Personal Data Breaches. Such measures shall (a) include, as appropriate, measures required pursuant to applicable Data Protection Legislation, including but not limited to Article 32 of the GDPR, and ensure a level of security appropriate to the risks represented by the processing and the nature of the data to be protected, having regard to the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, (b) require that all Customer Personal Data stored on any of Terryberry’s onsite storage devices be accessible via a secured network, (c) require that Terryberry encrypt all other transmissions of Customer Personal Data, including over public networks or wireless networks, and (d) require that Terryberry encrypt all Customer Personal Data stored on any removable or portable devices or media. Such encryption shall meet or exceed the accepted industry standards of data encryption used for Customer Personal Data and what is required by Applicable Laws. All personal data will be encrypted at rest and in transit. Terryberry shall reasonably assist the Customer in ensuring compliance with the Customer’s obligations pursuant to applicable Data Protection Legislation, taking into account the nature of the processing and the information available to Terryberry.

b. implement appropriate technical and organisational measures appropriate to the nature of the Customer Personal Data being protected, taking into account the nature and purposes of the processing, for the protection of the security of the Customer Personal Data to protect against unauthorised or unlawful processing and against accidental loss or destruction, damage, alteration or disclosure, details of which shall be supplied to Customer upon request and which measures Customer shall have the opportunity to review and assess in accordance with Customer's own obligations under Data Protection Legislation. Terryberry reserves the right to revise the technical and organisational measures at any time, without notice, provided that such revisions shall not reduce the level of security provided for the Customer Personal Data that Terryberry processes on behalf of Customer;

6.4. Breach Notification.

In respect of a Customer Personal Data Breach involving any Customer Personal Data processed by Terryberry on behalf of Customer, Terryberry shall:

a. inform Customer without undue delay if Terryberry becomes aware of any Customer Personal Data Breach with respect to any Customer Personal Data processed on behalf of Customer providing Customer with sufficient information to allow Customer to meet any obligations to report or inform supervisory authorities, data subjects and/or other entities of the Customer Personal Data Breach under the Data Protection Legislation. Such notification shall as a minimum:

b. describe the nature of the Customer Personal Data Breach, the categories and numbers of data subjects concerned, and the categories and numbers of Customer Personal Data records concerned;

c. communicate the name and contact details of Terryberry’s data protection officer or other relevant contact from whom more information may be obtained;

d. describe the likely consequences of the Customer Personal Data Breach; and

e. describe the measures taken or proposed to be taken to address the Customer Personal Data Breach, including, where appropriate, measures to mitigate its possible adverse effects.

f. Terryberry shall take prompt steps to remedy the Customer Personal Data Breach and mitigate any harmful effects, and shall take reasonable efforts to ensure that Subprocessors co-operate with Customer.

g. Terryberry shall co-operate with Customer and take such reasonable commercial steps as to assist in the investigation, mitigation and remediation of each such Customer Personal Data Breach.

6.5. Records and Audits.

a. Terryberry Obligations.

In respect of the Customer Personal Data processed by Terryberry on behalf of Customer, Terryberry shall:

i. maintain records and information in writing regarding all categories of Terryberry’s processing activities in respect of the Customer Personal Data to demonstrate Terryberry’s compliance with this Addendum and shall make such records available to the Customer or a supervisory authority or other competent regulatory authority upon request. Such record shall, at a minimum, contain the information required by applicable Data Protection Legislation, including but not limited to Article 30(2) of the GDPR;

ii. maintain records and information regarding Terryberry's processing activities in respect of Customer Personal Data to demonstrate Terryberry's compliance with this Addendum;

iii. allow for audits by Customer or Customer's designated auditor of Terryberry's systems and procedures relevant to the processing of the Customer Personal Data, provided that in the case of any audit:

b. Customer Obligations.

In respect of audits to the Customer Personal Data processed by Terryberry on behalf of Customer, Customer shall:

i. comply with any reasonable requirements or security restrictions that Terryberry may impose to safeguard Terryberry's systems, personal data Terryberry holds on behalf of other customers and Terryberry's own confidential or commercially sensitive information and to avoid unreasonable disruption to Terryberry's business and operations;

ii. except in the case of an audit due to a security breach, reimburse Terryberry for any time expended by Terryberry for any such audit, at Terryberry's then current professional services rates, which shall be made available to Customer upon request, which costs shall be reasonable, taking into account the resources expended by Terryberry; and

iii. before the commencement of any audit, mutually agree with Terryberry on the scope, timing, and duration of the audit (which agreement shall not be unreasonably withheld or delayed), subject to the requirements set forth in Section 6.5;

c. Audit Requirements.

i. Generally.

The parties acknowledge that Customer must be able to assess Terryberry’s compliance with its obligations under Data Protection Legislation, to the extent that Terryberry is acting as a processor on behalf of Customer. Customer further agrees that the audits described in Section 6.5(c)(ii) below meet Customer’s audit requirements, and Customer agrees to exercise any right it may have to conduct an inspection or audit (including under the Standard Contractual Clauses, as applicable) by written notice to Terryberry to carry out the audits described in Section 6.5(c)(ii).

ii. Certification.

Without prejudice to the rights granted in Section 6.5(c)(iii) below, if the requested audit scope is addressed in an ISO certification, SOC report or similar audit report issued by a qualified third party auditor within the prior twelve months and Terryberry provides such report to Customer upon request confirming that there are no known material changes in the controls audited, Customer agrees to accept the findings presented in such third party audit report in lieu of requesting an audit of the same controls covered in the report.

iii. Audit Procedures.

Upon not less than thirty (30) days’ advance written notice to Terryberry and no more frequently than once annually, with Terryberry’s reasonable costs of complying with any such request to be met by Customer, Terryberry shall (i) make available all information necessary to demonstrate to Customer its compliance with Article 28 of the GDPR, including without limitation, executive summaries of its information security and privacy policies, and (ii) cooperate with and respond promptly to Customer’s reasonable privacy and/or security questionnaire(s). Notwithstanding the above, if Customer’s request for audit occurs during Terryberry’s quarter or year end, or such other time during which Terryberry cannot reasonably accommodate such request, the parties shall mutually agree on an extension to the thirty (30) days’ advance written notification. Customer shall execute a confidentiality agreement in form and substance reasonably satisfactory to Terryberry prior to such audit. For the avoidance of doubt, nothing contained herein will allow Customer to review data pertaining to Terryberry’s other customers or partners. Customer shall bear its own costs and expenses with respect to the audits described in this Section 6.5(c)(iii). The Parties shall use all reasonable endeavors when exercising rights under this Section 6.5 to minimize disruption to Terryberry’s business activities.

6.6. Service Provider Requirements.

Customer discloses Personal Data to Terryberry solely for: (i) a valid business purpose; and (ii) Terryberry to perform the Services. Terryberry is prohibited from: (i) selling Customer’s personal data; (ii) collecting, retaining, using, or disclosing Customer’s personal data for any purpose other than providing the Services to Customer; and (iii) collecting, retaining, using, or disclosing Customer’s personal data outside of the direct business relationship between Terryberry and Customer; and (iv) combining Customer’s personal data with personal data that Terryberry obtains from other sources. Terryberry certifies that it understands the prohibitions outlined in this Section 6.6 and will comply with them. Customer understands and agrees that Terryberry may use subprocessors to provide the Services and process personal data on Customer’s behalf in accordance with Section 7 below. The parties agree that any monetary consideration provided by Customer to Terryberry is provided for the provision of the Services and not for the provision of personal data.

7. SUBPROCESSORS.

7.1. Authorization for Use of Subprocessors.

Customer provides general written authorization for:

a. Terryberry to engage the following types of subprocessors who may process the Customer Personal Data in connection with hosting the Site and providing the Terryberry Services: logistics providers; third parties involved in the manufacture and distribution of personalized, monogrammed or customized rewards; distributors and retailers of Rewards who Terryberry engages to send rewards directly to Customer and/or data subjects; providers of penetration testing services; providers of cloud storage; providers of hosted Site; Affiliates of Terryberry; and data centers; details of which are available to Customer upon request. For purposes of this Addendum, “Affiliate” means an entity controlling, controlled by, or under common control with a party (an entity will be deemed to have control if it owns over 50% of another entity). Terryberry may update the list of its processors from time to time. Customer acknowledges that such information is confidential.

b. Terryberry to appoint the types of processors set out in Section 7.1 above, including, but not limited to the processors set out at https://www.terryberry.com/subprocessor/, as processors of the Customer Personal Data under this Addendum. Terryberry shall have in place a written contract with such processors in respect of such processing of the Customer Personal Data.

c. Terryberry to appoint (and permit each Subprocessor appointed in accordance with this Section 7 to appoint) Subprocessors in accordance with this Section 7 and any restrictions in the SOW.

7.2. Use of Subprocessors.

With respect to each Subprocessor, Terryberry shall: (a) before the Subprocessor first Processes Customer Personal Data, carry out adequate due diligence to ensure that the Subprocessor is capable of providing the level of protection for Customer Personal Data required by the Order; and (b) ensure that the arrangement between on the one hand (i) Terryberry, or (ii) the relevant intermediate Subprocessor; and on the other hand the Subprocessor, is governed by a written contract including terms that offer at least the same level of protection for Customer Personal Data as those set out in this Addendum and the Principal Master Agreement and, without limiting the foregoing, meet any contractual requirements set forth under Data Protection Legislation, including Article 28(3) of the GDPR.

7.3. Notification of Subprocessors and Changes to Subprocessors.

Terryberry shall maintain an updated list of sub-processors at https://www.terryberry.com/subprocessor/(the “Privacy Center”).

7.4. Changes to Subprocessors.

If Terryberry or its Affiliates appoint a new (or remove an existing) subprocessor, it shall update the list at the Privacy Center. Customer may object to Terryberry’s appointment or replacement of a subprocessor by notifying Terryberry in writing of any reasonable objections within thirty (30) days of the update. Terryberry shall work with Customer in good faith to make available a commercially reasonable change in the provision of the Services which avoids the use of that proposed Subprocessor. Where such a change cannot be made within ten (10) days from Terryberry’s receipt of Customer’s notice, notwithstanding anything in the Order, Customer may, by written notice to Terryberry, with immediate effect terminate the Order to the extent that it relates to the Services which require the use of the proposed Subprocessor.

7.5. Acts and Omissions of Subprocessors.

Terryberry shall remain fully responsible and liable for all acts, omissions, and work performed by any of its Subprocessors, including its Subprocessors’ compliance with the terms and conditions of the Order (including this Master Agreement) and applicable Data Protection Legislation.

8. INTERNATIONAL TRANSFERS

8.1. International Transfer Acknowledgement.

Customer hereby agrees and acknowledges that: (a) some of Terryberry's servers are based outside of the EEA and UK, primarily in the U.S. where Terryberry's affiliated companies are based; (b) from time to time, Terryberry's subprocessors may conduct processing outside of the EEA and UK, and (c) Customer hereby consents to such processing of the Customer Personal Data outside of the EEA or UK in accordance with this Addendum and in accordance with Data Protection Legislation.

8.2. Requirements for Restricted Transfers.

To the extent that any Restricted Transfer occurs, Terryberry shall put in place prior to such transfer: (a) appropriate safeguards detailed in Section 8.3 below to protect such Customer Personal Data; and (b) enforceable data subject rights and effective legal remedies for data subjects as required by Data Protection Legislation.

8.3. Customer Personal Data Protection During Restricted Transfers.

To the extent that any Customer Personal Data (of which Customer is the data controller under Data Protection Legislation) is transferred outside of the EEA or UK by or on behalf of Terryberry, Terryberry shall ensure a similar degree of protection is afforded to such Customer Personal Data by ensuring the following safeguards are implemented:

a. Transfers to countries with adequate levels of protection for personal data.

Terryberry may transfer Customer Personal Data to a country that has been deemed to provide an adequate level of protection for personal data by the European Commission and/or the ICO without restriction.

b. Transfers to third countries.

To the extent that Terryberry processes any personal data under this Addendum that originates from the European Economic Area (“EEA”) or Switzerland in a country that has not been designated by the European Commission or the Swiss Federal Data Protection Authority (as applicable) as providing an adequate level of protection for personal data, or from one jurisdiction to another jurisdiction not recognized as adequate by the authorities of the exporter’s jurisdiction, the parties agree to enter into the Standard Contractual Clauses for the transfer of personal data to third countries as set out in the Annex to Commission Decision (EU) 2021/914 adopted on June 4, 2021 (“Standard Contractual Clauses”) which are hereby incorporated into and form part of this Addendum. The Parties agree to include the optional Clause 7 (Docking clause) to the Standard Contractual Clauses incorporated into this Addendum. With regards to clauses 8 to 18 of the Standard Contractual Clauses, the different modules will apply as follows:

i. Where Customer acts as a processor and Terryberry as a sub-processor (as applicable), both parties agree that Module Three will apply;

ii. Where Customer acts as a controller and Terryberry a processor (as applicable), both parties agree that Module Two will apply;

iii. Where Standard Contractual Clauses apply to transfers of personal data from Switzerland, the term 'member state' in the Standard Contractual Clauses must not be interpreted in such a way as to exclude data subjects in Switzerland from the possibility of suing for their rights in their place of habitual residence (Switzerland) in accordance with Clause 18(c) of the Standard Contractual Clauses.

iv. Where the Standard Contractual Clauses apply to the transfer of personal data from one jurisdiction (not being the EEA, the UK or Switzerland) to another jurisdiction not recognized as adequate by the authorities of the exporter’s jurisdiction, the competent supervisory authority and the governing law shall be those of the exporter’s jurisdiction. The term ‘member state’ in the Standard Contractual Clauses shall refer to the jurisdiction of the exporter.

c. Transfers from the UK by Customer to Terryberry.

To the extent that Terryberry processes under this Addendum any personal data that originates from the UK in a country that has not been designated by the UK Government as providing an adequate level of protection for personal data, and where the parties have implemented a valid mechanism for such transfers, the parties agree that such mechanism shall continue to apply to such transfers. To the extent that Terryberry processes under this Addendum any personal data that originates from the UK in a country that has not been designated by the UK Government as providing an adequate level of protection for personal data, and where the parties have not implemented a valid mechanism for such transfers, the parties agree (i) that the UK International Data Transfer Addendum (“UK Addendum”) to the EU Commission Standard Contractual Clauses as in force from 21 March 2022 as issued by the Information Commissioner’s Office under s.119A (1) of the UK Data Protection Act 2018 shall apply and is hereby incorporated by reference and (ii) that:

9.3.1. i. Table 2 of the UK Addendum shall be read by reference to clause 9.2.

9.3.2. ii. Table 3 of the UK Addendum shall be read by reference to clause 9.4;

9.3.3. iii. For the purposes of Table 4, both parties shall have the ability to terminate the UK Addendum.

8.4. Annexes.

The parties hereby agree that data processing details set out in Annex I of this Addendum shall apply for the purposes of Annex 1 of the Standard Contractual Clauses and the technical and organizational security measures set out in Annex II of this Addendum shall apply for the purpose of Annex 2 to the Standard Contractual Clauses. Terryberry shall be deemed the “data importer” and Customer the “data exporter” under the Standard Contractual Clauses, and the parties will comply with their respective obligations under the Standard Contractual Clauses. Customer grants Terryberry a mandate to execute the Standard Contractual Clauses (Module 3) with any relevant sub-processor (including Terryberry Affiliates). Unless Terryberry notifies Customer to the contrary, if the European Commission subsequently amends the Standard Contractual Clauses at a later date, such amended terms will supersede and replace any Standard Contractual Clauses executed between the parties.

8.5. Alternative Data Export Solution.

The parties agree that the data export solution identified in Section 8.3 will not apply if and to the extent that Customer adopts an alternative data export solution for the lawful transfer of personal data (as recognized under the Data Protection Legislation) from the EEA, UK or Switzerland, in which event, Customer shall reasonably cooperate with Terryberry to implement such solution and such alternative data export solution will apply instead (but solely to the extent such alternative data export solution extends to the territories to which personal data is transferred under this Addendum).

9. MISCELLANEOUS

9.1. Severability.

If any provision (or part of a provision) of this Addendum is found by any court or administrative body of competent jurisdiction to be invalid, unenforceable or illegal, the other provisions shall remain in force. If any invalid, unenforceable or illegal provision would be valid, enforceable or legal if some part of it were deleted, the provision shall apply with whatever modification is necessary to give effect to the commercial intention of the parties.

9.2. Term and Termination.

a. This Addendum will remain in full force and effect so long as: (a) the Order remains in effect; or (b) Terryberry retains any Customer Personal Data related to the Order in its possession or control (Term).

b. Any provision of this Addendum that expressly or by implication should come into or continue in force on or after termination of the Order in order to protect Personal Data will remain in full force and effect.

c. If a change in any Data Protection Legislation prevents either party from fulfilling all or part of its Order obligations, the parties will suspend the processing of Customer Personal Data until that processing complies with the new requirements. If the parties are unable to bring the Customer Personal Data processing into compliance with the Data Protection Legislation within 90 days, they may terminate the Order on written notice to the other party.

9.3. Governing Law; Jurisdiction.

This Addendum shall be governed by and construed in accordance with the governing law and jurisdiction provisions in the Master Agreement, unless otherwise required by Data Protection Legislation or the SCCs.

9.4. Entire Agreement.

This Addendum shall replace and supersede any existing data processing addendum (including any privacy addendums), attachment or exhibit (including any standard contractual clauses) between the parties, except as provided for in Section 9.4, if applicable. Any addenda, attachments, or exhibits related to security shall remain in place and supplement any security measures set out in Annex II. In the event of a conflict between Annex II and any other Master Agreement that Customer has entered into with Terryberry governing information security, including administrative, physical, or technical safeguards regarding the protection of data, the provisions more protective of the data shall prevail.

9.5. Liability.

Notwithstanding anything to the contrary in the Master Agreement or this Addendum, the liability of each Party and each Party’s Affiliates under this Addendum shall be subject to the exclusions and limitations of liability set out in the Master Agreement or, in the absence of such a provision in the Master Agreement, the following will apply: (a) in no event will either party’s maximum aggregate liability arising out of or related to the Master Agreement or this Addendum exceed the total amount paid or payable to Terryberry under the Master Agreement during the twelve (12) month period preceding the date of initial claim, and (b) neither party will have any liability to the other party for any loss of profits or revenues, loss of goodwill, loss or corruption of data or for any indirect, special, incidental, consequential or punitive damages arising out of, or in connection with the Master Agreement or this Addendum.

10. DEFINITIONS AND INTERPRETATION

10.1. Definitions.

In this Addendum, capitalized terms shall have the meaning set out below:

a. Applicable Laws: all laws (including laws relating to anti-bribery and anti-corruption), statutes, regulations, decisions, rulings, sanctions, governmental and regulatory policies, industry guidelines and/or codes of practice which may from time to time be in force in a relevant territory which is relevant to any rights and/or obligations under and/or the performance of this Addendum and/or the Order;

b. Customer Personal Data: means any information relating to an identified or identifiable natural person provided by Customer or accessed by Terryberry or processed by Terryberry on behalf of Customer as a result of, or in connection with, the provision of the services under the Order; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.

c. Customer Personal Data Breach: any actual misuse, compromise or breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data transmitted, stored or otherwise processed;

d. Data Protection Legislation: all applicable privacy and data protection laws in force from time to time in the United States and UK, including the California Consumer Privacy Act of 2018; EU General Data Protection Regulation 2016/679 (as the same forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018), the Data Protection Act 2018 and the Privacy and Electronic Communications (EC Directive) Regulations 2003, in each case as amended by the Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019 and 2020, and other state and federal privacy and data protection laws that are or may in the future be applicable to the Comprehensive Agreement and this Addendum, and as may be further amended, replaced or superseded from time to time.

e. Portal: Terryberry’s website hosted at such URL as Terryberry may elect from time to time and via which Customer can access the Site.

f. Restricted Transfer: means a transfer by either party of Customer Personal Data collected from any Data Subject in the European Economic Area (“EEA”) or UK to a country where such transfer would be prohibited by Data Protection Legislation in the absence of appropriate safeguards being in place prior to said transfer, such as agreeing to the Standard Contractual Clauses with the recipient of such Customer Personal Data.

g. Standard Contractual Clauses: means the contractual clauses adopted by the European Commission as of June 4, 2021 governing Restricted Transfers, the text of which is available at: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32021D0914&from=EN, including any updated, amended, or subsequent version thereof approved by the respective data protection authority.

h. Terryberry Services: the services supplied by Terryberry to Customer in connection with the operation of the Reward Program as set out in the Order;

i. Reward Program: the recognition and reward program developed by Terryberry and provided to Customer.

j. Order: the scope of the Terryberry Services required by Customer and to be delivered by Terryberry, the Order may also be referred to as the Master Agreement.

k. Site: a secure area of the Portal hosted by or on behalf of Terryberry designated for use by Customer to access the Reward Program.

10.2. Interpretation.

a. The terms “personal data”, “data controller”, “controller”, “data processor”, “processor”, “process”, “data subject”, “data protection impact assessment”, “third country” and “international organization” shall each have the applicable meaning set out in the Data Protection Legislation.

b. References to paragraphs and the Appendix are to paragraphs of and the appendix to this Addendum, unless stated otherwise. The Appendix and any annexes form a part of this Addendum.

c. Unless the context otherwise requires, words imparting the singular shall include the plural and vice versa. References to “persons” include a natural person, any body corporate, unincorporated association, firm, body (statutory or otherwise) or authority, whether or not having separate legal personality.

d. A reference to a statute or statutory provision is a reference to it as amended, extended or re-enacted from time to time and shall include all subordinate legislation made from time to time under that statute or statutory provision.

e. Any words following the terms “including”, “include”, “in particular”, “for example” or any similar expression shall be construed as illustrative and shall not limit the sense of the words, description, definition, phrase or term preceding those term.

ANNEX I

DETAILS OF PROCESSING

A. LIST OF PARTIES

Data exporter(s): Identity and contact details of the data exporter(s) and, where applicable, of its/their data protection officer and/or representative in the European Union/UK

Name: Customer name listed in the Master Agreement and/or the Order

Address: Address listed in the Master Agreement and/or the Order

Contact person’s name, position and contact details: Contact person for Customer listed in the Master Agreement and/or the Order

Activities relevant to the data transferred under these Clauses: Obtaining the Terryberry Services

Role (controller/processor): Controller

Data importer(s): Identity and contact details of the data importer(s), including any contact person with responsibility for data protection

Name: As set forth in the Master Agreement or the Order

Address: As set forth in the Master Agreement or the Order

Contact person’s name, position and contact details: Contact person for Terryberry listed in the Master Agreement and/or the Order

Activities relevant to the data transferred under these Clauses: Processing data related hosting a website and otherwise providing the Services as outlined in this Addendum and the Master Agreement

Role (controller/processor): Processor

B. DESCRIPTION OF TRANSFER

Categories of data subjects whose personal data is transferred

The data subjects to whom the Customer Personal Data relates will be primarily individual employees employed by Customer and who are entitled to participate in and benefit from the Services.

Categories of personal data transferred

The types of Customer Personal Data which Terryberry may process when hosting the Site and providing the Terryberry Services will include: name, including preferred name; job title; email address; date of birth/birthday; start date; award qualification date; cost center name; department; home address; business address; address for delivery of Rewards; telephone number; line manager name; line manager address; employee number/ID; length of service; Reward Points; location; award value; profile picture; payment data, including billing address; such other personal data as may be collected by Customer from the data subject and provided to Terryberry from time to time or which is otherwise uploaded, inputted, stored, transmitted and/or otherwise communicated to or via the Site.

Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures.

None.

The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis).

Data will be transferred throughout the term of the Order.

Nature of the processing and purpose(s) of the data transfer and further processing

Terryberry shall process the Customer Personal Data on behalf of Customer as a data processor for the purpose of hosting the Site and otherwise providing the Terryberry Services as outlined in this Addendum and the Order.

The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period

Terryberry shall not process the Customer Personal Data on behalf of Customer for any longer than is required for the purposes of providing the services of the Order. Following termination of the Order, Terryberry shall cease processing and delete all Customer Personal Data, save to the extent: (a) required by Applicable Law; (b) as a result of Terryberry's automatic archiving and backup procedures; and/or (c) to comply with bona fide internal compliance and audit policies and procedures. Terryberry shall not be liable to Customer for any such deletion of the Customer Personal Data.

For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing

Transfers to sub-processors will contain data of the same subject matter, for the same nature and duration of processing.

C. COMPETENT SUPERVISORY AUTHORITY

Identify the competent supervisory authority/ies in accordance with Clause 13:

Information Commissioner’s Office

ANNEX II

TECHNICAL AND ORGANISATIONAL MEASURES INCLUDING TECHNICAL AND ORGANISATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA

Domain	Practices
Information Security Management and Governance	Ownership for Security and Data Protection. Terryberry has appointed a risk & security officer responsible for coordinating and monitoring the security rules and procedures as well as data protection compliance. Security Roles and Responsibilities. Security responsibilities of personnel are formally documented and published in information security policies. Risk Management Program. Terryberry executes periodical risk assessments based on a formal risk management methodology.
Human Resources Security	Confidentiality obligations. Terryberry personnel with access to Customer Personal Data are subject to confidentiality obligations, and these are formally integrated into employment contracts. Termination. Terryberry ensures according to formal security administration procedures to ensure that access rights are timely revoked upon termination.
Asset Management	Asset Inventory. Terryberry maintains an inventory of all computing equipment and media used. Access to the inventories is restricted to authorized Terryberry personnel. Asset Handling Customer Personal Data on portable devices are encrypted. Terryberry has procedures for securely disposing of media and printed materials that contain Personal Data.
Information Access Control	Access Policy. Terryberry enforces an access control policy based on need-to-know and least privileges principles. Access Authorization Terryberry has implemented and maintains an authorization management system that controls access to systems containing Customer Personal Data. Every individual accessing systems containing Customer Personal Data has a separate, unique identifier/username. Terryberry restricts access to Customer Personal Data to only those individuals who require such access to perform their job function. Technical support personnel are only permitted to have access to Customer Personal Data when needed. Authentication Terryberry uses industry standard practices to identify and authenticate Authorized Users who attempt to access Terryberry network or information systems, including strong authentication. Where authentication mechanisms are based on passwords, Terryberry requires that the passwords are renewed periodically and that they are at least eight characters long and sufficiently complex. De-activated or expired identifiers/usernames are not granted to other individuals. Accounts will be locked out in case of repeated attempts to gain access to the information system using an invalid password. Terryberry maintains practices designed to ensure the confidentiality and integrity of passwords when they are assigned and distributed, and during storage.
Physical and Environmental Security	Physical Access to Facilities. Terryberry limits access to facilities where information systems that process Personal Data are located to identified authorized individuals. Physical access to data centers is only granted following a formal authorization procedure, and access rights are reviewed periodically Protection from Disruptions. Terryberry uses a variety of industry standard systems to protect its data centers against loss of data due to power supply failure and fire.
Operations Security	Data Recovery Procedures On an ongoing basis, but in no case less frequently than once a week (unless no data has been updated during that period), Terryberry maintains backup copies of Personal Data for recovery purposes. Terryberry stores copies of Personal Data and data recovery procedures in a different place from where the primary computer equipment processing the Personal Data is located. Malicious Software. Terryberry maintains anti-malware controls to help avoid malicious software gaining unauthorized access to Personal Data. Data Beyond Boundaries. Terryberry standardly encrypts, or provides the mechanisms to encrypt Personal Data that is transmitted over public networks.
Communications Security	Network Segregation. Terryberry has implemented a network segmentation policy and controls to avoid individuals gaining access to systems for which they have not been authorized. Information Transfer. Any transfer of Customer Personal Data to third parties is only performed following the execution of a formal written non-disclosure agreement.
System Acquisition, Development & Maintenance	Security Requirements. Requirements for protecting data and systems are analyzed and specified. Change Control. Terryberry has implemented a formal change management process to ensure changes to operational systems and applications are performed in a controlled way.
Vendor Relationships	Vendor Selection. Terryberry maintains a selection process by which it evaluates the security, privacy and confidentiality practices of a Sub-Processor in regard to data handling. Contractual Obligations. Vendors with access to Customer Personal Data are subject to data protection and information security obligations, and these are formally integrated into Terryberry contracts.
Information Security Incident Management	Terryberry maintains a record of security breaches with a description of the breach, the time, the consequences of the breach, the name of the reporter and to whom the breach was reported.
Business Continuity Management	Disaster Recovery. Terryberry maintains a disaster recovery plan for the facilities in which Terryberry information systems that process Customer Personal Data are located. Redundancy. Terryberry’s redundant storage and its procedures for recovering data are designed to attempt to reconstruct Customer Personal Data in its original or last-replicated state from before the time it was lost or destroyed.
Compliance	Security Reviews. Information security controls are independently audited and reported to management on a periodical basis.

**For transfers to (sub-) processors, also describe the specific technical and organisational measures to be taken by the (sub-) processor to be able to provide assistance to the controller and, for transfers from a processor to a sub-processor, to the data exporter.

**Transfers to subprocessors will substantially comply with the specifications listed above.