DocuSign Envelope ID: 634038A8-451B-4D2F-A754-B1AB50F49BC8

Amendment toUnity Data Processing Addendum
This Amendment to Unity Data Processing Addendum (“ DPA Amendment”) applies to the dataprocessing agreement between the entity identified as “Customer” below and Unity
Technologies SF (“Unity”) that governs the Customer’s use of the Unity Services (the“Agreement”). Customer enters into this DPA Amendment on behalf of itself and, to the extent
required under European Data Protection Laws, in the name and on behalf of its Authorized
Affiliates. For the purposes of this DPA Amendment, the term “Customer” shall include
Customer and its Authorized Affiliates, and shall have the same meaning as given to themunder the previous DPA. All capitalized terms not defined in this DPA Amendment shall have themeaning set forth in the Agreement.
You shall be deemed to have accepted this Amendment upon acceptance of the update. This isa pre-signed copy of this document and accompanying SCCs which you may download,
execute on your side, and return to DPA@unity3d.com. This Amendment will become effective
as of the earlier of when You either accept or execute the Amendment, or December 27th, 2022.
BackgroundIn 2021, the European Commission and the Swiss Federal Data Protection and Information
Commission issued new Standard Contractual Clauses ("2021 SCCs"). Additionally, in 2022, theUK Parliament approved the UK International Data Transfer Addendum to the EU SCCs (“UKAddendum”). The 2021 SCCs and UK Addendum replace the Standard Contractual Clauses
enacted in 2010 (“2010 SCCs”). Parties wish to amend the data processing agreement byincorporating this DPA Amendment (including the Standard Contractual Clauses) to update thetransfer mechanism to the 2021 SCCs and UK Addendum which ensures that the transfer ofCustomer Personal Data by Customer to Unity complies with European, UK, and Swiss Data
Protection Laws.
Agreed Terms
In consideration of the mutual promises set out in this DPA Amendment, the parties hereby
agree as follows:
1. The following terms shall have the following meanings:
a. “European Data Protection Laws” “European Data Protection Laws” means(a) Regulation 2016/679 (General Data Protection Regulation) (“EU GDPR”); (b)the EU GDPR as saved into United Kingdom law by virtue of section 3 of theEuropean Union (Withdrawal) Act 2018 (“UK GDPR”); and (c) the Swiss Federal
Data Protection Act and its implementing regulations (“Swiss Data ProtectionAct”); in each case as may be amended, superseded or replaced from time totime.

b. “Customer Personal Data” means the personal data made available by
Customer for processing by, or use within, the Covered Unity Services.
1

DocuSign Envelope ID: 634038A8-451B-4D2F-A754-B1AB50F49BC8

c. “Europe” means the European Economic Area (“EEA”), the United Kingdom(“UK”) and Switzerland.
d. “Services” means the Services directly provided by Unity to Customer that
require the processing by Unity of Customer Personal Data.
e. “Standard Contractual Clauses” or “SCCs” means the standard contractual
clauses annexed to the European Commission's Implementing Decision
2021/914 of 4 June 2021, as may be amended, superseded or replaced fromtime to time.
f.

“UK Addendum” means the International Data Transfer Addendum (versionB1.0) issued by the Information Commissioner's Office under S.119(a) of the UK
Data Protection Act 2018, as updated or amended from time to time.

2. Standard Contractual Clauses. The parties agree that, to the extent the transfer ofCustomer Personal Data to Unity involves a transfer to a country outside Europe that
does not provide an adequate level of protection for personal data (within the meaning ofapplicable European Data Protection Laws), the Standard Contractual Clauses shall bedeemed incorporated by reference and form an integral part of the Agreement as set outherein.
a. In relation to transfers of Customer Personal Data protected by the GDPR, theSCCs shall apply as follows:i.
The Module One Terms apply where the Customer is the data controller
and data exporter; and Unity is the data controller and data importerii.
The Module Two Terms apply where the Customer is the data controller
and data exporter; and Unity is the data processor and data importeriii.
Clause 7 Docking Clause: This optional clause allowing, with theagreement of the Parties, for an entity that is not a Party to these Clauses
to accede to these Clauses at any time shall apply.
iv.
Clause 9 (a) Use of sub-processors:
1. Module One: N/A
2. Module Two: Option 2 allowing for General Written Authorization
for the engagement of sub-processor(s) shall apply via themechanism specified in the Agreement shall apply.
v.
Clause 11 (a) Redress: This optional clause allowing for the appointmentof an independent dispute resolution body to receive complaints by thedata subjects shall not apply.
vi.
Clause 13 (a) Supervision:● Where the data exporter is established in an EU Member State: The
supervisory authority with responsibility for ensuring compliance by
the data exporter with Regulation (EU) 2016/679 as regards the datatransfer shall be Unity’s Competent Supervisory Authority, the Danish
Data Protection Agency● Where the data exporter is not established in an EU Member State,
but falls within the territorial scope of application of Regulation (EU)2DocuSign Envelope ID: 634038A8-451B-4D2F-A754-B1AB50F49BC8

vii.

viii.

2016/679 in accordance with its Article 3(2) and has appointed a
representative pursuant to Article 27(1) of Regulation (EU) 2016/679:
The supervisory authority of the Member State in which therepresentative within the meaning of Article 27(1) of Regulation (EU)2016/679 is established shall be Unity’s Competent Supervisory
Authority, the Danish Data Protection Agency● Where the data exporter is not established in an EU Member State,
but falls within the territorial scope of application of Regulation (EU)2016/679 in accordance with its Article 3(2) without however having toappoint a representative pursuant to Article 27(2) of Regulation (EU)2016/679: The supervisory authority of one of the Member States inwhich the data subjects whose personal data is transferred underthese Clauses in relation to the offering of goods or services to them,or whose behaviour is monitored, are located, shall be Unity’sCompetent Supervisory Authority, the Danish Data Protection Agency.
Clause 17 Governing Law: Option One allowing for these Clauses to begoverned by the law of one of the EU Member States, provided such law
allows for third-party beneficiary rights. The Parties agree that this DPA
will be governed by the laws of the applicable jurisdiction. In all othercases, this DPA shall be governed by the laws of the jurisdiction set forthin the Terms of Service.
Clause 18 (b) Choice of Forum and Jurisdictions: The Parties agree thatany dispute arising from these Clauses shall be resolved by the courts
provided for in No. 5 above.

b. In relation to transfers of Customer Personal Data protected by UK Data
Protection Laws,the Information Commissioner’s Office International Data
Transfer Addendum To The EU Commission Standard Contractual Clauses shallbe deemed incorporated by reference to this DPA Amendment.
i.
The Parties and Selected SCCs, Modules and Selected Clauses havebeen identified in this Annex A below
ii.
Either Importer or Exporter may end the Addendum as set out in Section
19 of the Addendum i.e.:○ 19. If the ICO issues a revised Approved Addendum underSection 18, if any Party selected in Table 4 “Ending the Addendum
when the Approved Addendum changes”, will as a direct result of
the changes in the Approved Addendum have a substantial,disproportionate and demonstrable increase in:■■a its direct costs of performing its obligations under theAddendum; and/or
b its risk under the Addendum,

and in either case it has first taken reasonable steps to reduce thosecosts or risks so that it is not substantial and disproportionate, then that
Party may end this Addendum at the end of a reasonable notice period,by providing written notice for that period to the other Party before thestart date of the revised Approved Addendum3

DocuSign Envelope ID: 634038A8-451B-4D2F-A754-B1AB50F49BC8

c. In relation to transfers of Customer Personal Data protected by the Swiss Data
Protection Act, the SCCs will be deemed completed in accordance with thisAnnex A except that:i.
Under Clause 13 of the EU SCCs, the competent supervisory authority isthe Swiss Federal Data Protection and Information Commission to theextent that the transfer is governed by the Swiss Federal Act on Data
Protection.
ii.
References to “Member State” in the 2021 Standard Contractual Clauses
refer to Switzerland, and data subjects may exercise and enforce theirrights under the 2021 Standard Contractual Clauses in Switzerland.
iii.
References to GDPR in the 2021 Standard Contractual Clauses refer tothe Swiss Federal Act on Data Protection (as amended and replaced).

3. Miscellaneous: This DPA Amendment shall replace any equivalent provisions in theAgreement regarding the transfer of Customer Personal Data that is subject to European
Data Protection Laws, including any prior or existing versions of the Standard
Contractual Clauses. All terms of the Agreements not expressly modified by thisAmendment shall continue to remain in effect. In the event of any conflict between thisDPA Amendment and the Agreement, the parties agree that the following order ofprecedence will apply: (a) the SCCs, (b) this DPA, and (c) the Terms of Service.

By signing below, each party acknowledges that it has read and understood the terms of thisDPA Amendment and agrees to be bound by them.

Unity Technologies SF

Customer:Signature:

Signature:

Printed Name: Jamie Crabtree

Printed Name:

Title: DPO

Title:

Date: December 16, 2022

Date:

DPO: Jamie Crabtree

DPO/Representative

DPO Email: dpo@unity3d.com

DPO/Rep Email:DPO Address: 30 3rd Street, San Francisco,

DPO/Rep Address:

94103

4DocuSign Envelope ID: 634038A8-451B-4D2F-A754-B1AB50F49BC8

ANNEX AANNEX 1(A): LIST OF PARTIES
Data exporter:

Name of data exporter: The entity identified as “Customer” in the Agreement and this DPA
Amendment
Contact person’s name, position and contact details: The contact details associated with
Customer's Unity account or as otherwise specified in this DPA Amendment or theAgreement.
Activities relevant to the data transferred: As indicated in Previous EU SCCs andAgreement
Signature and date: See front end of the DPA Amendment
Role (Controller/Processor): Controller (for Module One) or Controller (for Module Two)

Data importer:

Name of data exporter: Unity Technologies SF (except for SpeedTree Service, the Unity
Party shall be Interactive Data Visualization, Inc.)
Contact person’s name, position and contact details:Jamie Crabtree; DPO;
dpo@unity3d.com
Activities relevant to the data transferred: As indicated in Previous EU SCCs andAgreement
Signature and date: See front end of the DPA Amendment
Role (Controller/Processor): Controller (for Module One) or Processor (for Module Two)

ANNEX 1(B): DESCRIPTION OF THE TRANSFER
Categories of data
subjects whose
personal data istransferred:

As defined in Previous EU SCCs and Agreement

Categories of
personal datatransferred:

As defined in Previous EU SCCs and Agreement

Sensitive datatransferred (ifapplicable) andapplied restrictions
or safeguards:

As defined in Previous EU SCCs and Agreement

Frequency of thetransfer:

As defined in Previous EU SCCs and Agreement

Nature of theprocessing:

As defined in Previous EU SCCs and Agreement

5DocuSign Envelope ID: 634038A8-451B-4D2F-A754-B1AB50F49BC8

Purpose(s) of thedata transfer andfurther processing:

As defined in Previous EU SCCs and Agreement

The period for which
the personal data will
be retained, or, if thatis not possible, thecriteria used todetermine that
period:As defined in Previous EU SCCs and Agreement

For transfers to(sub-) processors,
also specify subject
matter, nature andduration of theprocessing

As defined in Previous EU SCCs and Agreement

ANNEX 1(C): COMPETENT SUPERVISORY AUTHORITY
CompetentSupervisoryAuthority

Unity’s Competent Supervisory Authority is the Danish Data Protection Agency, Carl
Jacobsens Vej 35, DK-2500 Valby; dt@datatilsynet.dk; +45 33 19 32 00

ANNEX 1(D): TECHNICAL AND ORGANISATIONAL MEASURES
Technical andSupervisory
Authority

Available upon request to DPA@unity3d.com

6