GDPR Data Protection Addendum

GDPR ADDENDUM

1 DEFINITIONS

1.1 In this Data Protection Addendum defined terms shall have the same meaning, and the same rules of interpretation shall apply as in the remainder of our Agreement. In addition, in this Data Protection Addendum the following definitions have the meanings given below:

2 PROCESSOR AND CONTROLLER

2.1 The parties agree that, for the Protected Data, the Client shall be the Controller, and the Company shall be the Processor. Nothing in our Agreement relieves the Client of any responsibilities or liabilities under any Data Protection Laws.

2.2 To the extent the Client is not sole Controller of any Protected Data it warrants that it has full authority and authorisation of all relevant Controllers to instruct the Company to process the Protected Data in accordance with our Agreement.

2.3 The Company shall process Protected Data in compliance with:

2.3.1 the obligations of Processors under Data Protection Laws in respect of the performance of its obligations under our Agreement; and

2.3.2 the terms of our Agreement.

2.4 The Client shall ensure that it, its Affiliates and each Authorised User shall at all times comply with:

2.4.1 all Data Protection Laws in connection with the processing of Protected Data, the use of the Services (and each part) and the exercise and performance of its respective rights and obligations under our Agreement, including maintaining all relevant regulatory registrations and notifications as required under Data Protection Laws; and

2.4.2 the terms of our Agreement.

2.5 The Client warrants, represents and undertakes, that at all times:

2.5.1 the processing of all Protected Data (if processed in accordance with our Agreement) shall comply in all respects with Data Protection Laws, including in terms of its collection, use and storage;

2.5.2 fair processing and all other appropriate notices have been provided to the Data Subjects of the Protected Data (and all necessary consents from such Data Subjects obtained and at all times maintained) to the extent required by Data Protection Laws in connection with all processing activities in respect of the Protected Data that may be undertaken by the Company and its Sub-Processors in accordance with our Agreement;

2.5.3 the Protected Data is accurate and up to date;

2.5.4 except to the extent resulting from Transfers to International Recipients made by the Company or any Sub-Processor, the Protected Data is not subject to the laws of any jurisdiction outside of the United Kingdom;

2.5.5 it shall establish and maintain adequate security measures to safeguard the Protected Data in its possession or control (including from unauthorised or unlawful destruction, corruption, processing or disclosure) and maintain complete and accurate backups of all Protected Data provided to the Company (or anyone acting on its behalf) so as to be able to immediately recover and reconstitute such Protected Data in the event of loss, damage or corruption of such Protected Data by the Company or any other person;

2.5.6 all instructions given by it to the Company in respect of Personal Data shall at all times be in accordance with Data Protection Laws; and

2.5.7 it has undertaken due diligence in relation to the Company’s processing operations and commitments, and it is satisfied (and at all times it continues to use the Services remains satisfied) that:

(a) the Company’s processing operations are suitable for the purposes for which the Client proposes to use the Services and engage the Company to process the Protected Data;

(b) the technical and organisational measures set out in the Information Security Addendum and our Agreement (each as Updated from time to time) shall (if the Company complies with its obligations under such Addendum and our Agreement) ensure a level of security appropriate to the risk in regard to the Protected Data as required by Data Protection Laws; and

(c) the Company has sufficient expertise, reliability and resources to implement technical and organisational measures that meet the requirements of Data Protection Laws.

3 INSTRUCTIONS AND DETAILS OF PROCESSING

3.1 Insofar as the Company processes Protected Data on behalf of the Client, the Company:

3.1.1 unless required to do otherwise by Applicable Law, shall (and shall take steps to ensure each person acting under its authority shall) process the Protected Data only on and in accordance with the Client’s documented instructions as set out in our Agreement (including with regard to Transfers of Protected Data to any International Recipient), as Updated from time to time (Processing Instructions);

3.1.2 if Applicable Law requires it to process Protected Data other than in accordance with the Processing Instructions, shall notify the Client of any such requirement before processing the Protected Data (unless Applicable Law prohibits such information on important grounds of public interest); and

3.1.3 shall promptly inform the Client if the Company becomes aware of a Processing Instruction that, in the Company’s opinion, infringes Data Protection Laws, provided that: (a) this shall be without prejudice to paragraphs 2.4 and 2.5; and

(b) to the maximum extent permitted by Applicable Law, the Company shall have no liability howsoever arising (whether in contract, tort (including negligence) or otherwise) for any losses, costs, expenses or liabilities (including any Data Protection Losses) arising from or in connection with any processing in accordance with the Processing Instructions following the Client’s receipt of the information required by this paragraph 3.1.3.

3.2 The Client agrees that:

3.2.1 the Company (and each Sub-Processor) is not obliged to undertake any processing of Protected Data that the Company reasonably believes infringes any of the Data Protection Laws and shall not be liable (or subject to any reduction or set-off of any Fees otherwise payable to the Company ) to the extent that it (or any Sub-Processor) is delayed in or fails to perform any obligation under our Agreement as a result of not undertaking any processing in such circumstances; and

3.2.2 without prejudice to any other right or remedy of the Company, in the event the Client has not resolved any Processing Instruction notified to it under paragraph 3.1.3 such that it is lawful in the Company’s opinion within 7 Business Days of such notification then such circumstances are a material breach of our Agreement by the Client that cannot be remedied and the Company may terminate our Agreement in accordance with its terms.

3.3 The Client shall be responsible for ensuring all Authorised Affiliates and Authorised Users read and understand the Privacy Policy (as Updated from time to time).

3.4 The Client acknowledges and agrees that the execution of any computer command to process (including deletion of) any Protected Data made in the use of any of the Subscribed Services by an Authorised User will be a Processing Instruction (other than to the extent such command is not fulfilled due to technical, operational or other reasons, including as set out in the User Manual). The Client shall ensure that Authorised Users do not execute any such command unless authorised by the Client (and by all other relevant Controller(s)) and acknowledges and accepts that if any Protected Data is deleted pursuant to any such command the Company is under no obligation to seek to restore it.

3.5 Subject to applicable Subscribed Service Specific Terms or the Order Form the processing of the Protected Data by the Company under our Agreement shall be for the subject-matter, duration, nature and purposes and involve the types of Personal Data and categories of Data Subjects set out in Schedule 1.

4 TECHNICAL AND ORGANISATIONAL MEASURES

4.1 The Company shall implement and maintain technical and organisational measures:

4.1.1 in relation to the processing of Protected Data by the Company, as set out the Information Security Addendum; and

4.1.2 to assist the Client insofar as is possible (taking into account the nature of the processing) in the fulfilment of the Client’s obligations to respond to Data Subject Requests relating

to Protected Data, in each case at the Client’s cost on a time and materials basis in accordance with the Company’s Standard Pricing Terms. The parties have agreed that (taking into account the nature of the processing) the Company’s compliance with paragraph 6.1 shall constitute the Company’s sole obligations under this paragraph 4.1.2.

5 USING STAFF AND OTHER PROCESSORS 5.1 Subject to paragraph 5.2, the Company shall not engage (nor permit any other Sub-Processor to engage) any Sub-Processor for carrying out any processing activities in respect of the Protected Data in connection with our Agreement without the Client’s prior written authorisation. The Client shall not unreasonably object to any new Sub-Processor (or any change to any of the Sub-Processors).

5.2 The Client:

5.2.1 authorises the appointment of each of the Sub-Processors identified on the List of Sub-Processors as at Order Acceptance; and

5.2.2 authorises the appointment of each Sub-Processor (or any change to any of the Sub-Processors) identified on the List of Sub-Processors as Updated from time to time. The Client’s right to object to the appointment of a new Sub-Processor (or any change to any of the Sub-Processors) following the relevant Update Notice introducing that change may be exclusively exercised by terminating our Agreement in accordance its rights following the Update Notification introducing the change before that Update takes effect in accordance with our Agreement.

5.3 The Company shall:

5.3.1 prior to the relevant Sub-Processor carrying out any processing activities in respect of the Protected Data, ensure each Sub-Processor is appointed under a written contract containing materially the same obligations as under paragraphs 2 to 12 (inclusive) (including those obligations relating to sufficient guarantees to implement appropriate technical and organisational measures);

5.3.2 ensure each new Sub-Processor identified on the List of Sub-Processors further to paragraph 5.2.2 has been operating for at least two years and has not been sanctioned by any Supervisory Authority in relation to any breach of any Data Protection Laws in the previous five years; and

5.3.3 remain fully liable for all the acts and omissions of each Sub-Processor as if they were its own.

5.4 The Company shall ensure that all persons authorised by it (or by any Sub-Processor) to process Protected Data are subject to a binding written contractual obligation to keep the Protected Data confidential (except where disclosure is required in accordance with Applicable Law, in which case the Company shall, where practicable and not prohibited by Applicable Law, notify the Client of any such requirement before such disclosure).

6 ASSISTANCE WITH COMPLIANCE AND DATA SUBJECT RIGHTS

6.1 The Company shall refer all Data Subject Requests it receives to the Client without undue delay. The Client shall pay the Company for all work, time, costs and expenses incurred by the Company or any Sub-Processor(s) in connection with such activity, calculated on a time and materials basis at the Company’s rates set out in the Company’s Standard Pricing Terms.

6.2 The Company shall provide such assistance as the Client reasonably requires (taking into account the nature of processing and the information available to the Company) to the Client in ensuring compliance with the Client’s obligations under Data Protection Laws with respect to:

6.2.1 security of processing;

6.2.2 data protection impact assessments (as such term is defined in Data Protection Laws);

6.2.3 prior consultation with a Supervisory Authority regarding high risk processing; and

6.2.4 notifications to the Supervisory Authority and/or communications to Data Subjects by the Client in response to any Personal Data Breach,

provided the Client shall pay the Company for all work, time, costs and expenses incurred the Company or any Sub-Processor(s) in connection with providing the assistance in this paragraph 6.2 calculated on a time and materials basis at the Company’s rates set out in the Company’s Standard Pricing Terms.

7 INTERNATIONAL DATA TRANSFERS 7.1 Subject to paragraphs 7.2 and 7.4, the Company shall not Transfer any Protected Data:

7.1.1 to any country or territory outside the United Kingdom; and/or

7.1.2 to an organisation and/or its subordinate bodies governed by public international law, or any other body which is set up by, or on the basis of, an agreement between two or more countries,

without the Client’s prior written authorisation except where required by Applicable Law (in which case the provisions of paragraph 3.1 shall apply).

7.2 The Client hereby authorises the Company (or any Sub-Processor) to Transfer any Protected Data for to any International Recipient(s) in accordance with paragraph 7.3, provided all Transfers of Protected Data by the Company (or any Sub-Processor) to an International Recipient shall (to the extent required under Data Protection Laws) be effected by way of Lawful Safeguards and in accordance with Data Protection Laws and our Agreement. The provisions of our Agreement (including this Data Protection Addendum) shall constitute the Client’s instructions with respect to Transfers in accordance with paragraph 3.1.1. 7.3 The Lawful Safeguards employed in connection with Transfers pursuant to paragraph 7.2 shall be as follows:

7.3.1 the country or territory to which it is proposed to Transfer the Protected Data has been determined by the European Commission, the UK Information Commissioner’s Office or another Supervisory Authority of competent jurisdiction to ensure an adequate level of protection for the rights and freedoms of Data Subjects under Article 45 the GDPR, Article 45 of the UK GDPR or equivalent Data Protection Laws as applicable (an “Adequacy Decision”); or

7.3.2 where the Transfer of Protected Data is to a country or territory which is not the subject of an Adequacy Decision, then:

(a) where the Personal Data are Transferred from a country or territory within the European Economic Area, the Transfer shall be subject to the SCCs; and

(b) where the Personal Data are Transferred from the United Kingdom, the Transfer shall be subject to the SCCs, as modified and supplemented by the UK Addendum; and

(c) where the Personal Data are Transferred from Switzerland, the Transfer shall be subject to the SCCs save that references therein to: (i) “European Union”, “Union” or “member state” shall be taken as references to Switzerland; and (ii) the GDPR shall be taken as including references to the equivalent provisions of the Swiss Federal Act on Data Protection (as amended or replaced).

7.4 The Client acknowledges that due to the nature of cloud services, the Protected Data may be Transferred to other geographical locations in connection with use of the Services further to access and/or computerised instructions initiated by Authorised Users. The Client acknowledges that the Company does not control such processing, and the Client shall ensure that Authorised Users (and all others acting on its behalf) only initiate the Transfer of Protected Data to other geographical locations if Lawful Safeguards are in place and that such Transfer is in compliance with all Applicable Laws.

8 INFORMATION AND AUDIT

8.1 The Company shall maintain, in accordance with Data Protection Laws binding on the Company, written records of all categories of processing activities carried out on behalf of the Client.

8.2 On request, the Company shall provide the Client (or auditors mandated by the Client) with a copy of the third party certifications and audits to the extent made generally available to its customers. Such information shall be confidential to Company and shall be Company’s Confidential Information as defined in our Agreement and shall be treated in accordance with applicable terms.

8.3 In the event that the Client, acting reasonably, deems the information provided in accordance with paragraph 8.2 insufficient to satisfy its obligations under Data Protection Laws, Company shall, on request by the Client make available to the Client such information as is reasonably necessary to demonstrate Company’s compliance with its obligations under this Data Protection Addendum and Article 28 of the GDPR, and allow for and contribute to audits, including inspections, by the Client (or another auditor mandated by the Client) for this purpose provided:

8.3.1 such audit, inspection or information request is reasonable, limited to information in Company’s possession or control and is subject to the Client giving Company reasonable (and in any event at least 60 days’) prior notice of such audit, inspection or information request;

8.3.2 the parties (each acting reasonably and consent not to be unreasonably withheld or delayed) shall agree the timing, scope and duration of the audit, inspection or information release together with any specific policies or other steps with which the Client or third party auditor shall comply (including to protect the security and confidentiality of other customers, to ensure Company is not placed in breach of any other arrangement with any other customer and so as to comply with the remainder of this paragraph 8.3);

8.3.3 the Client shall ensure that any such audit or inspection is undertaken during normal business hours, with minimal disruption to the businesses of Company;

8.3.4 the duration of any audit or inspection shall be limited to one Business Day;

8.3.5 all costs of such audit or inspection or responding to such information request shall be borne by the Client, and Company’s costs, expenses, work and time incurred in connection with such audit or inspection shall be reimbursed by the Client on a time and materials basis in accordance with Company’s Standard Pricing Terms;

8.3.6 the Client’s rights under this paragraph 8.3 may only be exercised once in any consecutive 12 month period, unless otherwise required by a Supervisory Authority or if the Client (acting reasonably) believes Company is in breach of this Data Protection Addendum;

8.3.7 the Client shall promptly (and in any event within one Business Day) report any non-compliance identified by the audit, inspection or release of information to Company;

8.3.8 the Client agrees that all information obtained or generated by the Client or its auditor(s) in connection with such information requests, inspections and audits shall be Company’s Confidential Information as defined in our Agreement, and shall be treated in accordance with applicable terms;

8.3.9 the Client shall ensure that each person acting on its behalf in connection with such audit or inspection (including the personnel of any third-party auditor) shall not by any act or omission cause or contribute to any damage, destruction, loss or corruption of or to any systems, equipment or data in the control or possession of Company while conducting any such audit or inspection; and 8.3.10 this paragraph 8.3 is subject to paragraph 8.4.

8.4 The Client acknowledges and accepts that relevant contractual terms agreed with Sub-Processor(s) may mean that Company or Client may not be able to undertake or facilitate an information request or audit or inspection of any or all Sub-Processors pursuant to paragraph 8.3 and:

8.4.1 the Client’s rights under paragraph 8.3 shall not apply to the extent inconsistent with relevant contractual terms agreed with Sub-Processor(s);

8.4.2 to the extent any information request, audit or inspection of any Sub-Processor are permitted in accordance with this paragraph 8.4, equivalent restrictions and obligations on the Client to those in paragraphs 8.3.1 to 8.3.10 (inclusive) shall apply together with any additional or more extensive restrictions and obligations applicable in the circumstances; and 8.4.3 paragraphs 5.3.1 and 8.3 shall be construed accordingly.

9 BREACH NOTIFICATION

9.1 In respect of any Personal Data Breach, Company shall, without undue delay (and in any event within 72 hours):

9.1.1 notify the Client of the Personal Data Breach; and

9.1.2 provide the Client with details of the Personal Data Breach.

10 DELETION OF PROTECTED DATA AND COPIES

Following the end of the provision of the Services (or any part) relating to the processing of Protected Data Company shall dispose of Protected Data in accordance with its obligations under our Agreement. Company shall have no liability (howsoever arising, including in negligence) for any deletion or destruction of any such Protected Data undertaken in accordance with our Agreement.

11 COMPENSATION AND CLAIMS 11.1 Subject to the limitation of liability provisions set out in clause 10 of the Enterprise Client – Terms and Conditions of Business, the Company shall be liable for Data Protection Losses (howsoever arising, whether in contract, tort (including negligence) or otherwise) under or in connection with our Agreement:

11.1.1 only to the extent caused by the processing of Protected Data under our Agreement and directly resulting from Company’s breach of our Agreement; and

11.1.2 in no circumstances to the extent that any Data Protection Losses (or the circumstances giving rise to them) are contributed to or caused by any breach of our Agreement by the Client (including in accordance with paragraph 3.1.3(b)).

11.2 If a party receives a compensation claim from a person relating to processing of Protected Data in connection with our Agreement or the Services, it shall promptly provide the other party with notice and full details of such claim.

11.3 The parties agree that the Client shall not be entitled to claim back from Company any part of any compensation paid by the Client in respect of such damage to the extent that the Client is liable to indemnify or otherwise compensate Company in accordance with our Agreement. 11.4 This paragraph 11 is intended to apply to the allocation of liability for Data Protection Losses as between the parties, including with respect to compensation to Data Subjects, notwithstanding any provisions under Data Protection Laws to the contrary, except:

11.4.1 to the extent not permitted by Applicable Law (including Data Protection Laws); and

11.4.2 that it does not affect the liability of either party to any Data Subject.

12 SURVIVAL

This Data Protection Addendum (as Updated from time to time) shall survive termination (for any reason) or expiry of our Agreement and continue until no Protected Data remains in the possession or control of Company or any Sub-Processor, except that paragraphs 10 to 12 (inclusive) shall continue indefinitely.

13 DATA PROTECTION CONTACT

Company’s Data Protection Officer is the General Counsel who may be contacted at dataprotection@360businesslaw.com.

SCHEDULE 1

DATA PROCESSING DETAILS – AILA CONTRACT REVIEW SERVICE

Subject-matter of processing: The processing of personal data in connection with the provision of the AiLa AI Contract Review Service for enterprises, as further described in the Schedule 2 – AI Contract Review Service – Special Conditions. This includes the analysis, review, and extraction of information from contracts and related legal documents submitted by or on behalf of the Client.

Duration of the processing: Processing will continue until the earlier of the final termination or final expiry of our Agreement, unless otherwise expressly stated within the Agreement.

Nature and purpose of the processing:

· Processing personal data as necessary to perform our contractual obligations under the Agreement;

· Processing personal data for the purpose of providing, maintaining, supporting, and improving the AiLa Service;

· Processing data as reasonably required to deliver AI-driven contract review functionality, including document parsing, clause recognition, risk identification, and legal annotation;

· Processing initiated or requested by Authorised Users in connection with their use of the AiLa Service, or by the Client, in each case in accordance with the terms of the Agreement;

· In relation to the AiLa Service, processing shall otherwise be in accordance with the specific purposes set out in the Subscribed Service Specific Terms.

Type of Personal Data: The personal data processed may include:

· Names, job titles, and contact information (such as email addresses and telephone numbers);

· Employer details and professional information;

· Personal data embedded within uploaded contracts and legal documents, including names, positions, signatures, and contractual roles of individuals;

· Metadata relating to document handling (e.g., timestamps, user identifiers).

Further detail is provided in the Subscribed Service Specific Terms, where applicable.

Categories of Data Subjects:

· Authorised Users of the AiLa Service;

· Employees, contractors, or representatives of the Client organisation;

· Individuals named or referenced within uploaded legal documents or contracts (such as employees, clients, suppliers, or counterparties).

Please refer to the Subscribed Service Specific Terms for any additional ca

tegories relevant to the AiLa Service.

The AiLa Service is not intended for the processing of special categories of personal data as defined in Article 9 of the UK GDPR. Clients are instructed not to submit documents containing sensitive personal data, such as:

· Health-related information;

· Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership;

· Genetic or biometric data for identification purposes;

· Information concerning an individual’s sex life or sexual orientation.

If special category data is inadvertently submitted, such data may be temporarily processed by the AiLa system during document analysis but is not used, stored, or retained for any longer than is technically necessary to perform the Service.

SCHEDULE 2

SUB PROCESSORS