Data Processing Addendum

Schedule 1 – Cross border transfers

PART 1 – EEA CROSS BORDER TRANSFERS

• 1. The parties agree that the terms of the Standard Contractual Clauses are hereby incorporated by reference and shall apply to an EEA Transfer.
  
• 2. Module Two (Controller to Processor) of the Standard Contractual Clauses shall apply where the EEA Transfer is effectuated by Customer as the data controller of the Personal Data and HeySam is the data processor of the Personal Data.
  
• 3. Module Three (Processor to Processor) of the Standard Contractual Clauses shall apply where the EEA Transfer is effectuated by Customer as the data processor of the Personal Data and HeySam is a Sub-processor of the Personal Data.
  
• 4. Sub-processor Transfers. HeySam makes no representations regarding the transfer mechanisms used by its Sub-processors beyond ensuring appropriate safeguards are in place as required by applicable Data Protection Laws.
  
• 5. Clause 7 of the Standard Contractual Clauses (Docking Clause) shall not apply.
  
• 6. Option 2: GENERAL WRITTEN AUTHORISATION in Clause 9 of the Standard Contractual Clauses shall apply, and the method for appointing and time period for prior notice of Sub-processor changes shall be as set forth in Section ‎5.2 of the DPA.
  
• 7. In Clause 11 of the Standard Contractual Clauses, the optional language will not apply.
  
• 8. In Clause 17 of the Standard Contractual Clauses, Option 1 shall apply, and the Parties agree that the Standard Contractual Clauses shall be governed by the laws of the Republic of Ireland.
  
• 9. In Clause 18(b) of the Standard Contractual Clauses, disputes will be resolved before the courts of the Republic of Ireland.
  
• 10. Annex I.A of the Standard Contractual Clauses shall be completed as follows:Data Exporter: Customer.Contact details: As detailed in the Agreement.Data Exporter Role:Module Two: The Data Exporter is a data controller.Module Three: The Data Exporter is a data processor.Signature and Date: By entering into the Agreement and DPA, Data Exporter is deemed to have signed these Standard Contractual Clauses incorporated herein, including their Annexes, as of the Effective Date of the Agreement.Data Importer: HeySam.Contact details: As detailed in the Agreement.Data Importer Role:Module Two: The Data Importer is a data processor.Module Three: The Data Importer is a sub-processor.Signature and Date: By entering into the Agreement and DPA, Data Importer is deemed to have signed these Standard Contractual Clauses, incorporated herein, including their Annexes, as of the Effective Date of the Agreement.
  
• 11. Annex I.B of the Standard Contractual Clauses shall be completed as followsThe categories of personal data and data subjects are described in Sections ‎2.1, ‎2.2 and ‎2.3 of the DPA.The Parties do not intend for Sensitive Data to be transferred.The frequency of the transfer is a continuous basis for the duration of the Agreement.The nature and purpose of the Processing is described in Sections ‎2.1, ‎2.2 and ‎2.3 of the DPA.The period for which the Personal Data will be retained is for the duration of the Agreement, unless agreed otherwise in the Agreement and/or the DPA.In relation to transfers to Sub-processors, the subject matter, nature, and duration of the processing is set forth in Section ‎5 of the DPA.
  
• 12. Annex I.C of the Standard Contractual Clauses shall be completed as follows:The competent supervisory authority in accordance with Clause 13 is the supervisory authority in the Member State stipulated in Section ‎7 above.
  
• 13. The information security standards referred to in the DPA serves as Annex II of the Standard Contractual Clauses
  
• 14. To the extent there is any conflict between the Standard Contractual Clauses and any other terms in this DPA or the Agreement, the provisions of the Standard Contractual Clauses will prevail.
  

PART 2 – UK Cross Border Transfers

• Table 1: The Parties: as detailed in Section 10 of Part 1 of this Schedule 1.
  
• Table 2: Selected SCCs, Modules and Selected Clauses: as detailed in Part 1 of this Schedule 1.
  
• Table 3: Appendix Information: means the information which must be provided for the selected modules as set out in the Appendix of the Standard Contractual Clauses (other than the Parties), and which is set out in Part 1 of this Schedule 1.
  
• Table 4: Ending this addendum when the Approved Addendum Changes: neither Party may end this Addendum as set out in Section 19 of this Part 2.The Alternative Part 2 Mandatory Clauses of the Approved Addendum, being the template Addendum B.1.0 issued by the Information Commissioner’s Office (ICO) and laid before the UK Parliament in accordance with s119A of the Data Protection Act 2018 on 28 January 2022, as it is revised under Section 18 of those mandatory clauses.
  

PART 3 – Switzerland Cross Border Transfers

• The Parties agree that the Standard Contractual Clauses as detailed in Part 1 of this Schedule 1, shall be adjusted as set out below where the Federal Act on Data Protection of 25 of September 2020 (the “FADP”) applies to Switzerland Transfers:
  
• 1. References to the Standard Contractual Clauses means the Standard Contractual Clauses as amended by this Part 3;
  
• 2. The Swiss Federal Data Protection and Information Commissioner (“FDPIC”) shall be the sole Supervisory Authority for Switzerland Transfers exclusively subject to the FADP;
  
• 3. The terms “General Data Protection Regulation” or “Regulation (EU) 2016/679” as utilized in the Standard Contractual Clauses shall be interpreted to include the FADP with respect to Switzerland Transfers.
  
• 4. References to Regulation (EU) 2018/1725 are removed.
  
• 5. Switzerland Transfers subject to both the FADP and the GDPR, shall be dealt with by the FDPIC, insofar as the Switzerland Transfer is governed by the FADP, and by the EU Supervisory Authority named in Part 1 of this Schedule 1, insofar as the Switzerland Transfer is governed by the GDPR
  
• 6. References to the “Union”, “EU” and “EU Member State” shall not be interpreted in such a way as to exclude Data Subjects in Switzerland from the possibility of exercising their rights in their place of habitual residence (Switzerland) in accordance with Clause 18(c) of the Standard Contractual Clauses;
  
• 7. Where Switzerland Transfers are exclusively subject to the FADP, all references to the GDPR in the Standard Contractual Clauses are to be understood to be references to the FADP;
  
• 8. Where Switzerland Transfers are subject to both the FADP and the EU GDPR, all references to the GDPR in the Standard Contractual Clauses are to be understood to be references to the FADP insofar as the Switzerland Transfers are subject to the FADP;
  

PART 4 – additional Safeguards

• 1. In the event of any Cross-Border Transfer, the Parties agree to supplement these with the following safeguards and representations, where appropriate:
  
• a. The Data Importer shall have in place and maintain in accordance with good industry practice measures to protect the Personal Data from interception (including in transit from the Data Exporter to the Data Importer and between different systems and services). This includes having in place and maintaining network protection intended to deny attackers the ability to intercept data and encryption of Personal Data whilst in transit and at rest intended to deny attackers the ability to read data.
  
  b. The Data Importer will respond to government requests as required by applicable laws. Where permitted by such laws, Data Importer will consider commercially reasonable efforts to resist requestsrelating to the Personal Data protected under GDPR, FADP or the UK GDPR, including under section 702 of the United States Foreign Intelligence Surveillance Act (“FISA”);
  
  c. If the Data Importer becomes aware that any government authority (including law enforcement) wishes to obtain access to or a copy of some or all of the Customer’s Personal Data, whether on a voluntary or a mandatory basis, then unless legally prohibited or under a mandatory legal compulsion that requires otherwise:
  
• I. The Data Importer will notify the Data Exporter immediately after first becoming aware of such demand for access to Customer’s Personal Data and provide the Data Exporter with all relevant details of the same, unless and to the extent legally prohibited to do so;
  
  II. The Data Importer shall inform the relevant government authority that the Data Importer is a processor of the Customer’s Personal Data and that the Data Exporter and/or Controller has not authorized the Data Importer to disclose the Customer’s Personal Data to the government authority, and inform the relevant government authority that any and all requests or demands for access to the Customer’s Personal Data should therefore be notified to or served upon the Data Exporter and/or Controller in writing;
  
  III. The Data Importer may, in its sole discretion, challenge any such demandfor access to Customer’s Personal Data which is under the Data Importer’s control. Notwithstanding the above, (a) the Data Exporter acknowledges that such challenge may not always be reasonable or possible in light of the nature, scope, context and purposes of the intended government authority access, and (b) if, taking into account the nature, scope, context and purposes of the intended government authority access to Customer’s Personal Data, the Data Importer has a reasonable and good-faith belief that urgent access is necessary to prevent an imminent risk of serious harm to any individual or entity, this subsection (c)(III) shall not apply. In such event, the Data Importer shall notify the Data Exporter, as soon as possible, following the access by the government authority, and provide the Data Exporter with relevant details of the same, unless and to the extent legally prohibited to do so.
  
• 2. Once in every 12-month period, the Data Importer will inform the Data Exporter, at the Data Exporter’s written request, to the extent permitted by applicable law, of the types of binding legal demands for Personal Data it has received and solely to the extent such demands have been received, including national security orders and directives, which shall encompass any process issued under section 702 of FISA.