DATA PROCESSING ADDENDUM
Last updated: June 20, 2023
This Data Processing Addendum (hereinafter “DPA”) forms part of the agreement between Centric
Software and Customer (the “Agreement”) whereby Centric Software is providing software licenses,
maintenance, hosting, and/or services to Customer (hereinafter the “Services”). This DPA shall beeffective as of the Effective Date of the Agreement (“Effective Date”).
1. Definitions“Applicable Data Protection Legislation” means any data protection laws and all other regulations
applicable to Centric Software’s Processing of Customer’s Personal Data under the Agreement(including as applicable the EU Data Protection Legislation).
“Commission”, “Controller”, “Data Subject”, “Personal Data”, “Process/Processing” “Processor”,“Supervisory Authority” and “Personal Data Breach” shall have the same meaning as in the GDPR.
“Customer’s Personal Data” means any Personal Data provided by Customer (or any Customer’s
authorized user) to Centric Software through Customer’s use of Centric Software’s Services, asdetailed in Appendix 1 “Description of Processing”.
"EEA" means the European Economic Area, which consists in European Union, Liechtenstein, Iceland
and Norway.
“EU Data Protection Legislation” means as applicable to Centric Software’s Processing of Customer’s
Personal Data (i) the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and any delegatedand implementing acts adopted in accordance with the GDPR, (ii) the Swiss Federal Data Protection
Act of 19 June 1992 and its Ordinance (“Swiss FDPA”); and (iii) in respect to the UK, the GDPR as saved
into the United Kingdom law by virtue of section 3 of the United Kingdom’s European Union(Withdrawal) Act 2018 (“UK GDPR”) and the UK Data Protection Act 2018 (together the “UK Data
Protection Legislation”); in each case as such laws may be amended or superseded from time to time.
“Public Authority” means a government agency or law enforcement authority, including judicial
authority.
“Restricted Transfer” means; (i) where the GDPR applies, a Transfer of Customer’s Personal Data fromthe EEA to a country outside of the EEA which is not subject to an adequacy determination by theEuropean Commission; (ii) where the UK Data Protection Legislation applies, a Transfer of Customer’s
Personal Data from the UK to any other country which is not based on adequacy regulations pursuant
to Section 17A of the UK Data Protection Act 2018; and (iii) where the Swiss FDPA applies, a Transfer
of Customer’s Personal Data to a country outside of Switzerland which is not included on the list ofadequate jurisdictions published by the Swiss Federal Data Protection and Information
Commissioner.
“Standard Contractual Clauses” (SCCs) means the Standard Contractual Clauses (module 2: Controller
to Processor) pursuant to Commission implementing decision (EU) 2021/914 of 4 June 2021.
“Sub-Processor” means any Processor appointed by Centric Software or by any other Centric
Software’s Sub-Processor, which receives, from Centric Software or from any other Centric Software’s
Sub-Processor, Customer’s Personal Data for the sole and exclusive purpose of performing Processing

1
Centric Software DPA 2023

on behalf of Customer after the Transfer in accordance with the terms of this Agreement and a written
subcontract between such Sub-Processor and the Processor.
“Technical and Organizational Measures” (TOMs) means those appropriate measures available atCentric Software TOMs that are aimed at Processing Customer’s Personal Data in compliance with theApplicable Data Protection Legislation.
“Transfer” means (i) a transmission of Customer’s Personal Data from Customer to Centric Software,or (ii) an onward transmission of Customer’s Personal Data from Centric Software to a Sub-Processor,
or between two Sub-Processors.
“Transfer Impact Assessment” means the transfer impact assessment required pursuant to Clause
14 of the Standard Contractual Clauses which may be updated from time to time by the parties withnew or updated information.
“UK Addendum” means the International Data Transfer Addendum to the EU Commission Standard
Contractual Clauses (version B1.0), in force 21 March 2022 issued by the Information Commissioner’s
Office under S.119(A) of the UK Data Protection Act 2018, as updated or amended from time to time.
The word "include" shall be construed to mean include without limitation, and cognate terms shallbe construed accordingly.
Defined terms can be used in a singular or plural form.
All other capitalized definitions in this DPA not explicitly defined in this DPA shall have the same
meanings as defined in the Agreement, the GDPR or the other Applicable Data Protection Legislation,in that order of precedence.
2. Scope and Roles
This DPA applies where and only to the extent that Centric Software Processes Customer’s Personal
Data on behalf of Customer in the course of providing its Services to Customer and such Customer’s
Personal Data is subject to the Applicable Data Protection Legislation. Accordingly, Customer is theController of Customer’s Personal Data and Centric Software shall Process Customer’s Personal Dataas Processor. Each party will separately comply with its obligations under Applicable Data Protection
Legislation when Processing Personal Data as a Controller (or functionally equivalent role under
Applicable Data Protection Legislation).
3. Customer’s Processing of Customer’s Personal Data
Customer acknowledges and agrees that it is and shall at all times remain the sole Controller ofCustomer’s Personal Data that will be Processed as part of its access to and use of Centric Software’s
Services. Customer is responsible for the accuracy, quality and legality of the Customer’s Personal
Data. Customer warrants and represents to Centric Software that it has provided notice and obtained
all consents, permissions and rights necessary for Centric Software and its Sub-Processors to lawfully
Process Customer’s Personal Data for the purposes contemplated by the Agreement (including this
DPA). Customer shall be responsible for complying with all Applicable Data Protection Legislation
including, but not limited to, (i) Transfer of Personal Data, (ii) information of Data Subjects and (iii)
access, modification and deletion rights of Data Subjects.

2
Centric Software DPA 2023

4. Centric Software’s Processing of Customer’s Personal Data
To the maximum extent permitted by Applicable Data Protection Legislation and for the duration of
the Processing of Customer’s Personal Data, Centric Software will Process Customer’s Personal Datain accordance with the Customer’s written reasonable instructions which are detailed below, whichshall in all circumstances be consistent with such Agreement and the Applicable Data Legislation.
Customer instructs Centric Software to Process Personal Data for the following purposes: (i)Processing in accordance with the Agreement (including this DPA), which includes supplying theServices and preventing or addressing service or technical issues; (ii) Processing initiated by
Customer’s User(s) in their use of the Services; (iii) Processing to comply with other reasonable
instructions provided by Customer and/or Customer’s User(s) (e.g., via email) where such instructions
are consistent with the terms of the Agreement and Applicable Data Protection Legislation; and (iv) as
otherwise required by applicable law. The Agreement and this DPA, along with Customer’s
configuration and use of the Services, are Customer's complete and final instructions to Centric
Software in relation to the Processing of Customer’s Personal Data, including for purposes of theStandard Contractual Clauses, and any Processing required outside of the scope of these instructions(inclusive of the rights and obligations set forth under the Agreement) will require prior writtenagreement of the parties. Appendix 1 “Description of Processing” to this DPA sets out certain
information regarding Centric Software’s Processing of Customer’s Personal Data notably as requiredby the article 28(3) of the GDPR.
5. Access to Customer’s Personal Data
Centric Software will ensure that access to Customer’s Personal Data is limited to its employees,
agents or contractors and those of its affiliates who need to know the relevant Customer’s Personal
Data, as necessary for the purposes of the Agreement and who are bound by an appropriate
obligation of confidentiality.
6. Customer’s Personal Data Breach
If Centric Software has reason to believe that a Personal Data Breach impacting Customer’s Personal
Data which Centric Software is Processing has occurred, Centric Software will: (i) notify Customer of
the Persona Data Breach without undue delay after becoming aware of such Personal Data Breachand (ii) provide Customer with available information allowing it to comply with its notification
obligations with the competent supervisory authority. Such notification is not an acknowledgementof fault or responsibility.
In case of a Customer’s Personal Data Breach and prior to making any required public statement or
required notice, Customer agrees to timely provide Centric Software with a draft for discussion on thecontent of its intended required public statements or required notices for the affected Data Subjects
and/or required notices to the relevant regulators regarding Customer’s Personal Data Breach to theextent such public statements or notices identify Centric Software by name or relate to Centric
Software’s Services. This draft shall be discussed in a timely fashion and in good faith between theparties. Notwithstanding the preceding sentence, Customer shall not be required to prejudice its
obligations under Applicable Data Protection Legislation.

3
Centric Software DPA 2023

7. Centric Software’s Assistance.
7.1. General assistance. Centric Software will reasonably assist Customer in complying with its
obligations as Controller under sections 32 through 36 of the GDPR, taking into account thenature of Processing as described in the Agreement and as described in this DPA.
7.2. Audit. Centric Software will make available to Customer all necessary information in its
possession to demonstrate Centric Software’s compliance with its obligations provided for by
the Applicable Data Protection Legislation to the extent it relates to the Processing by Centric
Software of Customer’s Personal Data as Controller. Centric Software uses external auditors
to verify the adequacy of its security measures with respect to its Processing of Customer’s
Personal Data. Such audits are performed at least once per year during the term of theAgreement at Centric Software’s expense, by an independent third-party security
professional at Centric Software’s sole selection and result in the generation of a confidential
audit report (“Audit Report”). Either on Centric Software Security and Data Privacy Website orupon prior written request at reasonable intervals and subject to the confidentiality
provisions of the Agreement, Centric Software shall make available to Customer information
regarding Centric Software’s compliance with the obligations set forth in this DPA in the formof a copy of the summary of the then-current Audit Report. Such third-party audits orcertifications may also be shared with Customer’s competent supervisory authority on its
request. In the event compliance with Applicable Data Protection Legislation cannot beshown through the appropriate documentation provided by Centric Software, Centric
Software will allow for an audit. Such audits will be subject to the following cumulative
conditions:o Customer shall provide Centric Software with at least thirty (30) days prior written
notice;o the scope of such audit shall be limited to both: (a) Customer’s Personal Data
Processing activities and storage facilities operated by Centric Software and (b)assessing Centric Software’s compliance with the Applicable Data Protection
Legislation in the specific subject area where the documentation provided by Centric
Software was not sufficient. Centric Software shall have the right to reasonably adapt
the scope of any audit to avoid or mitigate risks with respect to, and including, service
levels, availability, and confidentiality of other Centric Software’s customers’
information;o such audit shall be conducted by an independent auditor that is not a Centric Software
competitor at Customer’s cost. Prior to the audit, such independent auditor shall enter
into a non-disclosure agreement containing confidentiality provisions no lessprotective than those set forth in the Agreement to protect Centric Software’s
proprietary information;o such audits may not be performed more than once every twelve (12) months.
All information gathered during the audit as well as the audit report created from the audit
is confidential and cannot be divulged to third parties (unless mandated by applicable law)
without Centric Software’s prior written consent. Customer must promptly provide Centric
Software with information regarding any non-compliance discovered during the course of anaudit.

4
Centric Software DPA 2023

7.3. Data Protection Impact Assessment and Prior Consultation. So long as Customer does nototherwise have access to the relevant information, and to the extent such information isavailable to Centric Software, Centric Software shall provide reasonable assistance toCustomer needed to fulfil Customer’s obligation under Applicable Data Protection Legislation
to carry out a data protection impact assessment related to Customer’s use of the Service (atCustomer’s expense only if such reasonable cooperation will require Centric Software toassign significant resources to that effort) or prior consultations with supervisory authorities
as required by Applicable Data Protection Legislation.
8. Data Subjects Rights
When Centric Software receives a request from a Data Subject for access to, correction, update or
erasure of their Personal Data or a request to restrict Processing (“Data Subject Request”), Centric
Software will, to the extent legally permitted, promptly notify Customer and redirect Data Subject
Request to Customer.
To the extent Customer does not have the ability to independently correct, amend, or delete
Customer’s Personal Data, or block or restrict Processing of Customer’s Personal Data, then at
Customer’s written direction and to the extent required by Applicable Data Protection Legislation,
Centric Software, as Processor, shall assist Customer to fulfil its obligations in responding to requests
from Data Subjects to exercise their rights under Applicable Data Protection Legislation in a mannerconsistent with the performance of the Agreement. To the extent legally permitted, Customer shall be
responsible for any reasonable costs arising from Centric Software’s or its Sub-Processors’ provisionof such assistance.
9. Sub-Processing
9.1
Centric Software is a worldwide multi-tiered organization, located in the Americas, Asia andEurope. In that globalized context, in order for Centric Software to provide the Services, Customer
appoints Centric Software as Processor and agrees that Customer’s Personal Data may be Transferred
to, stored, accessed and Processed in any country in which Centric Software or its subcontractors arelocated. Centric Software will ensure that data protection obligations no less stringent than those set
forth in this DPA shall be imposed on the Sub-Processors by way of a contract and/or the standard
contractual clauses from the European Commission in such a manner that the Processing will meetthe requirements of the Applicable Data Protection Legislation.
The list of the Sub-Processors, that may be involved in the Processing of Customer’s Personal Data
due to the Processing activities implemented on behalf of Customer and authorized by Customer at
the Effective Date of this DPA is set forth at Centric Software List of Sub-Processors.
9.2.
Centric Software will inform Customer of any intended changes concerning the addition of
new Sub-Processors or replacement of existing Sub-Processors, thereby giving Customer theopportunity to object to such changes. Customer will be notified at least fifteen (15) days in advance
before Centric Software authorizes any new Sub-Processor to Process Customer’s Personal Data,
except in case of emergency. Customer may reasonably object to Centric Software’s use of a new SubProcessor if (i) such new Sub-Processor Processes Customer’s Personal Data and (ii) Customer
demonstrates it has a legitimate interest in objecting to this new Sub- Processor and notifies Centric,

5
Centric Software DPA 2023

in writing, within fifteen (15) days after receipt of the notification. In the absence of an objection from
Customer, the new Sub-Processor shall be deemed to be accepted by Customer. If Customer notifies
Centric Software of its objection to the new Sub-Processor within the above timeframe, the parties
will discuss Customer’s concerns in good faith with a view to achieve resolution. If Customer canreasonably demonstrate the new Sub-processor is unable to Process Customer’s Personal Data incompliance with the terms of this DPA and Centric Software cannot provide an alternative SubProcessor, or the parties are not otherwise able to achieve resolution as provided in the preceding
sentence within thirty (30) days, Customer, as its sole and exclusive remedy, may terminate thosespecific elements of the Centric Software Services impacted by this change of Sub-Processor before
the end of the notice period specified herein.
10. Security
Centric Software will implement and maintain appropriate TOMs,. Such TOMs are designed to protect
Customer’s Personal Data from a Personal Data Breach and to help ensure the ongoing confidentiality,
integrity, and availability of the Customer’s Personal Data and Processing systems.
Customer acknowledges that the Centric Software TOMs are subject to technical progress anddevelopment and that Centric Software may update or modify them from time to time provided thatsuch updates and modifications do not result in the degradation of the overall security of themeasures implemented by Centric Software.
The TOMs may also be completed by specific terms as detailed in the Documentation associated toeach release of the Software p and/or Services ordered by Customer.
Customer is responsible for reviewing the information Centric Software makes available regarding its
TOMs and data security, including its Audit Reports, and for making an independent determination as
to whether the Services meet the Customer’s requirements and legal obligations, including its legal
obligations under the Applicable Data Protection Legislation.
11. International Provisions
11.1.
Jurisdiction Specific Terms. To the extent Centric Software process Customer’s Personal
Data originating from and protected by any Application Data Protection Legislation in oneof the jurisdictions listed in Appendix 2 “Jurisdiction Specific Terms” of this DPA, the terms
specified in Appendix 2 “Jurisdiction Specific Terms” with respect to the applicablejurisdiction(s) apply in addition to the terms of this DPA.
11.2.
Restricted Transfers. Either party may make Restricted Transfers if it complies with theprovisions on Restricted Transfers in applicable EU Data Protection Legislation and this
DPA. To the extent Customer’s use of the Services requires an onward transfer
mechanism to lawfully transfer Customer’s Personal Data from an European jurisdiction(i.e., the European Economic Area, the United Kingdom, Switzerland) to Centric Software
located outside of that jurisdiction (“Transfer Mechanism”), the terms set forth inAppendix 3 “International Transfer Mechanism” of this DPA will apply.
12. Term and termination of this DPAThis DPA comes into force on the Effective Date, as specified above, and will continue for the term of
the Agreement.

6
Centric Software DPA 2023

Upon termination or expiration of the Agreement, Centric Software will:• at Customer’s option, either delete or return all Customer’s Personal Data to Customer; and• delete all existing copies, of Customer’s Personal Data in its possession in accordance with theterms and timelines of such Agreement, except (i) where applicable law requires retention ofCustomer’s Personal Data or where Customer’s Personal Data is necessary for evidentiary
purposes during the applicable statute of limitations, and (ii) except for automated system
backup copies that may not with reasonable efforts be destroyed, provided, however, thatsuch copies are not accessed or used by Centric Software and are destroyed in due course inaccordance with Centric Software’s standard document destruction policies and practices.
In any event, Centric Software will maintain Customer’s Personal Data securely and protect it from any
further Processing for as long as Centric Software retains such Personal Data. The terms of this DPA
shall survive for so long as Centric Software continues to retain any of Customer’s Personal Data.
13. Liability
Any claims arising out of, in connection with, or related to this DPA, whether in contract, tort or under
any other theory of liability are subject to the terms and conditions, including but not limited to the
exclusions and limitations, set forth in the Agreement.
In no event shall any party limit its liability with respect to any individual's data protection rights under
this DPA or otherwise. Customer shall indemnify Centric Software, as applicable, against any and allsuch claims or costs of any kind that exceed the exclusions and limitations set forth in the Agreement.
Centric Software shall not be liable for the damage caused by a Processing and/or in case of noncompliance with the Applicable Data Protection Legislation as a result of a Processing resulting in an
administrative fine issued by a Supervisory Authority or a court against Customer unless such damage
or non-compliance directly results from:• Acts of Centric Software beyond or contrary to Customer’s written instructions;• Failure of Centric Software’s employees to comply with their applicable confidentiality
obligations;• Partial or total non-performance of the TOMs as set out in the Agreement.
When Customer and Centric Software are liable (i) for the damage caused by the Processing to one orseveral Data Subjects and/or (ii) in case of non-compliance with the Applicable Data Protection
Legislation as a result of a Processing resulting in an administrative fine finally awarded by aSupervisory Authority or a court against one party, the parties agree to negotiate in good faith thedetermination of the portion of liability corresponding to the share of responsibility of each party inthe execution of the damage and/or the non-compliance and, if applicable, of the amount due by one
party to the other party for compensation, within six (6) months from notification by one party to theother party. Upon the failure of the parties to agree on the determination of the quantum, within the
aforementioned time period, the parties may decide to submit the determination of the quantum
corresponding to the share of liability of each party to the court of competent jurisdiction as
determined in this DPA.

7
Centric Software DPA 2023

14. Miscellaneous• Customer acknowledges and agrees that nothing in the Agreement or this DPA shall prevent
Centric Software from exercising its right to use and disclose Personal Data relating to and/or
obtained in connection with the operation, support and/or use of the Centric Software’s
products for its legitimate business purposes, including billing, account management,
technical support, product development, sales and marketing.
• Entire agreement. Except for the changes made by this DPA, the Agreement remains
unchanged and in full force and effect. If there is a discrepancy, inconsistency or contradiction
between this DPA and the Agreement, the provisions of this DPA shall prevail, but solely withrespect to the purpose of this DPA. In addition, it is explicitly agreed that in case of discrepancy,inconsistency or contradiction between the Standard Contractual Clauses and the DPA, theStandard Contractual Clauses shall prevail.
• Severability. If any provision of this DPA is found by a court of competent jurisdiction or
arbitrator to be illegal, void or unenforceable, the other provisions shall remain in full force
and effect, and the affected provision will be modified so as to render it enforceable andeffective to the maximum extent possible in order to effect the original intent of the parties.
• Governing law and jurisdiction. This DPA shall be governed by and construed in accordancewith governing law and jurisdiction provisions in the Agreement, unless required otherwise by
the Applicable Data Protection Legislation.
• Updates. Centric Software may update the terms of this DPA from time to time. The thencurrent terms of this Addendum are available at Centric Software Data Processing Terms andConditions.

8
Centric Software DPA 2023

APPENDIX 1 – DESCRIPTION OF PROCESSING
1. Categories of Data Subjects whose Customer’s Personal Data is Processed
Customer’s Data Subjects may include:• Customer’s Users, including employees, contractors, collaborators, partners, suppliers,
stakeholders and/or customers of the Customer, depending on the terms of the Agreement
and on Customer’s use of Centric Software’s software licenses, and/or Services;• Any other Data Subject whose Personal Data is included in Customer’s Personal Data.
2. Categories of Customer’s Personal Data Processed
The categories of Customer’s Personal Data that may be Processed by Centric Software as Processor,
depending on Customer’s use of the software licenses and/or Services, are the following:• First name, last name;• Email address;• Job title;• Phone number;• Connection data (IP address, logs, etc.);• Online identifies (user ID);
• Password;• Address
Depending on the terms applicable to each release of Centric Software’s software licenses, hosting,and/or Services, Customer may elect to provide Centric Software with other categories of Personal
Data.
However, Customer acknowledges and agrees that the Centric Software’s products are not dedicatedto Process any sensitive Personal Data or special category of data, as defined by the Applicable Data
Protection Legislation, unless a dedicated written agreement is executed between the parties.
3. Nature and Purpose of the Processing
Centric Software Processes Customer’s Personal Data to provide the software products and/or
Services as specified under the Agreement including:• Making software licenses available, whether on-premise or on a hosted basis, providing SaaS
Services• Providing technical support for Centric Software’s software products• Providing consulting services for implementation of such software.
• Hosting Customer Data where hosting or SaaS is purchased.
Depending on the software products and/or Services ordered by Customer, Centric Software will
Process Customer’s Personal Data for the following purposes:• Collection, access, use, storage and deletion of Customer Personal Data;• Authentication mechanism.

9
Centric Software DPA 2023

4. Duration of the Processing
Centric Software Processes Customer’s Personal Data for the duration of the software licenses,
hosting, and/or services as specified under the Agreement. Upon termination or expiration of theAgreement, Centric Software will delete all Customer’s Personal Data to Customer in accordance withthe terms and timelines of such Agreement, except where applicable law requires retention of such
Customer’s Personal Data or where such Customer’s Personal Data is necessary for proof purposes
during the applicable statute of limitation.
Customer may retrieve Customer’s Personal Data pursuant to the procedures described in theAgreement.
5. For Processing by Sub-Processors, also specify subject matter, nature and duration of theProcessing
In order to provide the software products and/or Services, Centric Software may appoint othercompanies as Sub-Processors which may receive, from Centric Software or from any other SubProcessor of Centric Software, Customer’s Personal Data for the sole and exclusive purpose to Processactivities to be carried out on behalf of Customer in accordance with the terms of the Agreement andthe terms of a written subcontract.
Centric Software will ensure that the same data protection obligations as set forth in the Agreement
shall be imposed on the Sub-Processors by way of a contract and/or the standard contractual clauses
from the European Commission in such a manner that the Processing will meet the requirements of
the Applicable Data Protection Legislation.
The list of Sub-Processors is set forth at Centric Software List of Sub-Processors.

10
Centric Software DPA 2023

APPENDIX 2 - JURISDICTION SPECIFIC TERMS
1. Australia
1.1. The definition of “Applicable Data Protection Legislation” includes the Australian Privacy
Principles and the Australian Privacy Act (1988).
1.2. The definition of “Personal Data” includes “Personal Information” as defined under Applicable
Data Protection Legislation.
2. Brazil
2.1. The definition of “Applicable Data Protection Legislation” includes the Lei Geral de Proteçãode Dados (LGPD).
2.2. The definition of “Personal Data Breach” includes a security incident that may result in any
relevant risk or damage to data subjects.
2.3. The definition of “Processor” includes “operator” as defined under Applicable Data Protection
Legislation.
3. Canada
3.1. The definition of “Applicable Data Protection Legislation” includes the Federal Personal
Information Protection and Electronic Documents Act (PIPEDA).
3.2. Centric Software’s Sub-processors, as set forth in Section 9 “Sub-processing” of this DPA, arethird parties under Applicable Data Protection Legislation, with whom Centric Software hasentered into a written contract that includes terms substantially similar to this DPA. Centric
Software has conducted appropriate due diligence on its Sub-processors.
3.3. Centric Software will implement technical and organizational measures as set forth in Section
10 “Security” of this DPA.
4. European Economic Area (EEA)
4.1. The definition of “Applicable Data Protection Legislation” includes the General Data
Protection Regulation (EU 2016/679) (“GDPR”).
4.2. When Centric Software engages a Sub-processor under Section 9 “Sub-Processing” of this
DPA, it will:(a) require any appointed sub-processor to protect the Customer’s Personal Data to thestandard required by Applicable Data Protection Legislation, such as including the samedata protection obligations referred to in Article 28(3) of the GDPR, in particular providing
sufficient guarantees to implement appropriate technical and organizational measures insuch a manner that the processing will meet the requirements of the GDPR, and(b) require any appointed Sub-processor to (i) agree in writing to only process personal data
in a country that the European Union has declared to have an “adequate” level ofprotection or (ii) only process personal data on terms equivalent to the Standard
Contractual Clauses or pursuant to a Binding Corporate Rules approval granted bycompetent European Union data protection authorities.
4.3. Notwithstanding anything to the contrary in this DPA or in the Agreement (including, without
limitation, either party’s indemnification obligations), neither party will be responsible for any
GDPR fines issued or levied under Article 83 of the GDPR against the other party by aregulatory authority or governmental body in connection with such other party’s violation of
the GDPR.

11
Centric Software DPA 2023

5. Israel
5.1. The definition of “Applicable Data Protection Legislation” includes the Protection of Privacy
Law (PPL).
5.2. The definition of “Controller” includes “Database Owner” as defined under Applicable Data
Protection Legislation.
5.3. The definition of “Processor” includes “Holder” as defined under Applicable Data Protection
Legislation.
5.4. Centric Software will require that any personnel authorized to process Customer’s Personal
Data comply with the principle of data secrecy and have been duly instructed about
Applicable Data Protection Legislation. Such personnel sign confidentiality agreementswith Centric Software in accordance with Section 5 “Access to Customer’s Personal Data” ofthis DPA.
5.5. Centric Software must take sufficient steps to ensure the privacy of data subjects byimplementing and maintaining the security measures as specified in Section 10 “Security”
of this DPA and complying with the terms of the Agreement.
5.6. Centric Software must ensure that the Customer’s Personal Data will not be transferred toa Sub-processor unless such Sub-processor has executed an agreement with Centric
Software pursuant to Section 9 “Sub-processing” of this DPA.
6. Japan
6.1. The definition of “Applicable Data Protection Legislation” includes the Act on the Protectionof Personal Information (APPI).
6.2. The definition of “Personal Data” includes “information about a specific individual
applicable under Section 2(1) of the APPI, which are provided by Customer (or any
Customer’s authorized user) to Centric Software through Customer’s use of Centric
Software’s Services.
6.3. The definition of “Controller” includes “Business Operator” as defined under Applicable
Data Protection Legislation.
6.4. The definition of “Processor” includes a business operator entrusted by the Business
Operator with the handling of personal data in whole or in part (also a “trustee”), as defined
under Applicable Data Protection Legislation. As a trustee of Customer’s Personal Data,
Centric Software will ensure that the use of the entrusted Customer’s Personal Data issecurely controlled.
6.5. Centric Software agrees it has and will maintain a privacy program conforming to thestandards prescribed by rules of the Personal Information Protection Commission
concerning the handling of personal data pursuant to the provisions of Chapter 4 of the
APPI. Accordingly:(a) Centric Software will (i) process Personal Data as necessary to provide the Services to
Customer in accordance with the Agreement and as set forth in Schedule 1 (Details of
the Processing) of this DPA (“Purpose of Use”) and (ii) not process Personal Data for any
purpose other than the Purpose of Use without Customer’s consent;(b) Centric Software will implement and maintain measures appropriate and necessary to
prevent unauthorized disclosure and loss of Personal Data and for the securemanagement of personal data in accordance with the APPI as set forth at Centric
Software TOMs;(c) Centric Software will notify Customer for (i) a failure to comply with Section 6.3(a) of
this Appendix 2 or (ii) Centric Software’s discovery of a Personal Data Breach impacting

12
Centric Software DPA 2023

6.6.

Customer Personal Data, in either case, in accordance with Section 6 “Customer’s
Personal Data Breach”. Centric Software will provide reasonable assistance toCustomer in the event that Customer is required to notify a regulatory authority or any
data subjects impacted by a Customer Personal Data Breach;(d) Centric Software will ensure that any of its employees who have access to Customer
Personal Data (i) have executed employee agreements requiring them to keep such
Customer Personal Data confidential and (ii) who violate confidentiality will be subject
to disciplinary action and possible termination; (iii) carry out appropriate employeesupervision and training for the secure management of personal data; and (iv) limit the
number of authorized personnel, including Centric Software’s employees, who haveaccess to Customer’s Personal Data and control such access such that it is only
permitted for the time period necessary for the Purpose of Use;(e) Centric Software will not disclose Customer Personal Data to any third party, except as
Customer has authorized Centric Software to do so in the Agreement. When engaging
sub-processors, Centric Software will comply with the obligations in Section 9(Subprocessing) of this DPA to ensure that procedures are in place to maintain theconfidentiality and security of Customer Personal Data;(f) Centric Software will keep records of the handling of Customer Personal Data entrusted
to it by, and performed for, Customer;(g) Centric Software will promptly notify Customer of any Data Subject Request and not
respond to such Data Subject Request without Customer’s prior consent, except aslegally required to do so or to confirm that such Data Subject Request relates to
Customer. To the extent Customer does not have the ability to resolve a Data Subject
Request from a Data Subject through the self-service features made available via theServices, then, upon Customer’s request, Centric Software will provide reasonable
cooperation and support to assist Customer in resolving such Data Subject Requestfrom a Data Subject in accordance with Section 8 (Data Subject Rights) of this DPA;(h) Customer may assess Centric Software’s compliance with its obligations under
Applicable Data Protection Legislation and as set forth in Section 7.2 “Audits” of this
DPA;(i) To the extent it relates to the Processing of the Customer Personal Data by Centric
Software, Centric Software will provide reasonable cooperation to Customer upon
written request, where Customer is reporting to the Personal Information Protection
Commission or other regulatory authorities; andThe following data subject consent terms apply: (a) Customer entrusts Centric Softwarewith the Customer Personal Data for the Purpose of Use. Customer agrees that Centric
Software is not a “third party” as the term is used in the APPI provisions that restrict theprovision of personal data to third parties. As such, the requirement to obtain data subject
consent in advance for domestic transfers within Japan do not apply. As such, the APPI
restrictions on the provision of personal data to third parties in foreign countries outsideof Japan, which require data subject consent in advance of such international transfers do
not apply.

13
Centric Software DPA 2023

7. Mexico:7.1. The definition of “Applicable Data Protection Legislation” includes the Federal Law for theProtection of Personal Data Held by Private Parties and its Regulations (FLPPIPPE).
7.2. When acting as a processor, Centric Software will:(a) treat Personal Data in accordance with Customer’s instructions set forth in Section 4“Centric Software’s Processing of Customer’s Personal Data” of this DPA;(b) process Customer Personal Data only to the extent necessary to provide the Services;(c) implement security measures in accordance with Applicable Data Protection Law andSection 10 “Security” of this DPA;(d) keep confidentiality regarding the Customer Personal Data processed in accordancewith the Agreement;(e) delete all Customer Personal Data upon termination of the Agreement in accordancewith Section 12 “Term and Termination of this DPA” of this DPA; and(f) only transfer Personal Data to sub-processors in accordance with Section 9(Subprocessing) of this DPA.
8. Singapore
8.1. The definition of “Applicable Data Protection Legislation” includes the Personal Data
Protection Act 2012 (PDPA).
8.2. Centric Software will Process Customer’s Personal Data to a standard of protection inaccordance with the PDPA by implementing adequate technical and organizational
measures as set forth in Section 10 “Security” of this DPA and complying with the terms of
the Agreement.
9. Switzerland
9.1. The definition of “Applicable Data Protection Legislation” includes the Swiss Federal Data
Protection Act of 19 June 1992 and its Ordinance 2012 (“Swiss FDPA”).
9.2. When Centric Software engages a Sub-processor under Section 9 “Sub-processing” of this
DPA, it will:(a) require any appointed Sub-processor to protect the Customer Content to the standard
required by Applicable Data Protection Legislation, such as including the same dataprotection obligations referred to in Article 28(3) of the GDPR, in particular providing
sufficient guarantees to implement appropriate technical and organizational measuresin such a manner that the processing will meet the requirements of the GDPR, and(b) require any appointed Sub-Processor to (i) agree in writing to only process Customer’s
Personal Data in a country that Switzerland has declared to have an “adequate” level ofprotection or (ii) only process Customer’s Personal Data on terms equivalent to theStandard Contractual Clauses or pursuant to a Binding Corporate Rules approval
granted by competent European Union data protection authorities.
10. United Kingdom (UK)
10.1. The definition of “Applicable Data Protection Legislation” includes the UK Data Protection
Legislation.
10.2. When Centric Software engages a Sub-Processor under Section 9 “Sub-processing” of this
DPA, it will:

14
Centric Software DPA 2023

(c) require any appointed sub-processor to protect the Customer’s Personal Data to thestandard required by Applicable Data Protection Legislation, such as including thesame data protection obligations referred to in Article 28(3) of the UK GDPR, in
particular providing sufficient guarantees to implement appropriate technical andorganizational measures in such a manner that the processing will meet therequirements of the UK GDPR, and(d) require any appointed Sub-processor to (i) agree in writing to only Process Customer’s
Personal Data in a country that the United Kingdom has declared to have an “adequate”
level of protection or (ii) only Process Customer’s Personal Data on terms equivalent to
the UK International Data Transfer Agreement or pursuant to a Binding Corporate
Rules approval granted by competent United Kingdom data protection authorities.
10.3. Notwithstanding anything to the contrary in this DPA or in the Agreement (including,
without limitation, either party’s indemnification obligations), neither party will be
responsible for any UK GDPR fines issued or levied under Article 83 of the UK GDPR against
the other party by a regulatory authority or governmental body in connection with suchother party’s violation of the UK GDPR.
11. United States of America
11.1. “US State Privacy Laws” mean all state laws relating to the protection and processing of
personal data in effect in the United States of America, which may include, without
limitation, the California Consumer Privacy Act, as amended by the California Privacy Rights
Act (“CCPA”), the Virginia Consumer Data Protection Act, the Colorado Privacy Act, theConnecticut Data Privacy Act, and the Utah Consumer Privacy Act.
11.2. The definition of “Applicable Data Protection Law” includes US State Privacy Laws.
11.3. The following terms apply where Centric Software processes Customer Personal Data
subject to the CCPA:(a) The term “personal information”, as used in this Section 11.3, will have the meaning
provided in the CCPA;(b) Centric Software is a service provider when processing Customer Personal Data.
Centric Software will process any personal information only for the business purposes
set forth in the Agreement, including the purpose of processing and processing
activities set forth in this DPA (“Purpose”). As a service provider, Centric Software will
not sell or share Customer Personal Information or retain, use, or disclose Customer
Personal Information (i) for any purpose other than the Purpose, including retaining,
using, or disclosing Customer Personal Information for a commercial purpose otherthan the Purpose, or as otherwise permitted by the CCPA; or (ii) outside of the directbusiness relationship between Customer and Centric Software;(c) Centric Software will (i) comply with obligations applicable to it as a service provider
under the CCPA and (ii) provide Customer Personal Information with the same level ofprivacy protection as is required by the CCPA. Customer is responsible for ensuringthat it has complied, and will continue to comply, with the requirements of the CCPA
in its use of the Services and its own processing of Customer Personal Information;(d) Customer will have the right to take reasonable and appropriate steps to help ensurethat Centric Software uses Customer Personal Information in a manner consistent
with Customer’s obligations under the CCPA;

15
Centric Software DPA 2023

(e) Centric Software will provide reasonable additional and timely assistance to assist
Customer in complying with its obligations with respect to consumer requests as set
forth in the Agreement.

16
Centric Software DPA 2023

APPENDIX 3 - INTERNATIONAL TRANSFER MECHANISM
1. Order of Precedence
In the event the Services are covered by more than one Transfer Mechanism, the Transfer ofCustomer’s Personal Data will be subject to a single Transfer Mechanism in accordance with thefollowing order of precedence: (a) the Standard Contractual Clauses as set forth in Section 2 “Standard
Contractual Clauses or SCCs” below of this Appendix 3 ; (c) the UK Addendum as set forth in Section
4 “UK Transfers” below of this Appendix 3; and, if neither (a) nor (b) is applicable, then (c) otherapplicable data Transfer Mechanisms permitted under Applicable Data Protection Legislation.
2. Standard Contractual Clauses
The parties agree that the Standard Contractual Clauses will apply only to the Processing ofCustomer’s Personal Data by Centric Software Transferred via the Services from the EEA or
Switzerland, either directly or via onward transfer, to any country or recipient outside the EEA or
Switzerland to (i) any country that does not ensure an adequate level of data protection within themeaning of EU Data Protection Legislation (ii) to any recipient which is not subject to other binding
obligations, code of conduct or certification as determined to be sufficient by the Supervisory
Authority or (iii) any recipient not covered by a suitable framework recognized by the relevant
authorities or courts as providing an adequate level of protection for personal data, including but notlimited to Binding Corporate Rules for Processors. For data transfer that are subject to the Standard
Contractual Clauses, the Standard Contractual Clauses will be deemed entered into, and incorporated
in this DPA by this reference, and completed as follows:(a) In Clause 9 of the SCCs, Option 2 will apply and the time period for written notice of subprocessor changes will be as set forth in Section 9.2 of this DPA;(b) In Clause 11 of the SCCs, the optional language will not apply;(c) In Annex I, Part A of the SCCs shall be completed as follows:
Data Exporter:
Name: Customer, as defined in the Agreement.
Address: Customer address as defined in the Agreement
Contact person’s name, position and contact details: the email address(es) designated by
Customer.
Signature and Date: By entering into the Agreement, Data Exporter is deemed to have signed
these Standard Contractual Clauses incorporated herein, including their Annexes, as of theEffective Date of this DPA.
Data Importer:
Name: Centric Software, as defined in the Agreement
Address: Centric Software, as defined in the Agreement
Contact person’s name and position: Centric Software’s Data Protection Officer may becontacted by mail: privacy@centricsoftware.com
Signature and Date: By entering into the Agreement, Data Importer is deemed to have signed
these Standard Contractual Clauses incorporated herein, including their Annexes, as of theEffective Date of this DPA.
(d) In Annex I, Part B of the SCCs:(i)
The categories of data subjects are set forth in Sections 1 and 2 of Appendix 1“Description of Processing” of this DPA;(ii)
The frequency of the transfer is a continuous basis for the duration of the Agreement;

17
Centric Software DPA 2023

(iii)The nature and purpose of the processing are set forth in Section 3 of Appendix 1“Description of Processing” of this DPA;(iv)
The period for which the Customer’s Personal Data will be retained is as set forth in
Section 4 of Appendix 1 “Description of Processing” of this DPA;(v)
For processing by Sub-Processors, the subject matter, nature and duration of theprocessing is set forth in Section 5 of Appendix 1 “Description of Processing” of thisDPA.
(e) In Annex I, Part C of the SCCs: the supervisory authority with responsibility for ensuring
compliance by the Data Exporter is as provided in Clause 13 of the SCCs.
(f) The Centric Software TOMs serve as Annex II of the SCCs.
3. Swiss Transfers
To the extent that Customer’s Personal Data Transfers from Switzerland are subject to the Standard
Contractual Clauses in accordance with Section 2 of this Appendix 3, the following amendments will
apply to the Standard Contractual Clauses:(a) References to “Regulation (EU) 2016/679” shall be interpreted as references to the Swiss FDPA
(as applicable);(b) References to specific Articles of “Regulation (EU) 2016/679” shall be replaced with theequivalent article or section of the Swiss FDPA (as applicable);(c) References to “EU”, “Union”, “Member State” and “Member State law” shall be replaced withreferences to the “Switzerland”, or “Swiss law” (as applicable);(d) The term “member state” shall not be interpreted in such a way as to exclude data subjects in
Switzerland from the possibility of suing for their rights in their place of habitual residence(i.e., Switzerland);(e) Clause 13(a) and Part C of Annex I are not used and the “competent supervisory authority” isthe Swiss Federal Data Protection Information Commissioner (as applicable);(f) References to the “competent supervisory authority” and “competent courts” shall be replacedwith references to the “Swiss Federal Data Protection and Information Commissioner” and“applicable courts of Switzerland” (as applicable);(g) In Clause 17, the SCCs shall be governed by the laws of Switzerland; and with respect totransfers to which the Swiss FDPA applies,(h) Clause 18(b) shall state that disputes shall be resolved before the applicable courts of
Switzerland.
4. UK Transfers
Any conflict between the terms of the SCCs and the UK Addendum shall be resolved in accordancewith Section 10 and Section 11 of the UK Addendum. In addition, Tables 1 to 3 in Part 1 of the UK
Addendum shall be deemed completed with the information set out in Appendices 4 to 6. Table 4
in Part 1 of the UK Addendum shall be deemed completed by selecting “neither party”.
Customer and Centric Software agree that the UK International Data Transfer Agreement will
apply to Customer’s Personal Data that is transferred from the United Kingdom, either directly or
via onward transfer, to any country or recipient outside of the United Kingdom that is notrecognized by the competent United Kingdom regulatory authority or governmental body for theUnited Kingdom as providing an adequate level of protection for personal data. For data transfersfrom the United Kingdom that are subject to the UK Addendum, the UK Addendum will be deemed
entered into, and incorporated into this DPA by this reference, and completed as follows:

18
Centric Software DPA 2023

(a) In Table 1 of the UK Addendum, Customer's and Centric Software's details and key contact
information are set forth in Section 2(c) of this Appendix 3;(b) In Table 2 of the UK Addendum, information about the version of the Approved EU SCCs,
modules, and selected clauses, which the UK Addendum is appended to, are set forth in
Section 2 “Standard Contractual Clauses or SCCs” of this Appendix 3;(c) In Table 3 of the UK Addendum:(i)
The list of Parties is set forth in Section 2(c) of this Appendix 3;(ii)
The description of the transfer is set forth in Section 3 “Nature and Purpose of theProcessing” of Exhibit 1 “Description of the Processing”;(iii)
Annex II is available at .
(iv)
The Centric Software TOMs serve as Annex II of the UK Addendum.
(v)
The list of sub-processors is set forth at Centric Software List of Sub-Processors; and(d) In Table 4 of the UK Addendum, both the Importer and the exporter may end the UK
Addendum in accordance with the terms of the UK Addendum.
5. Alternative Transfer Mechanism.
To the extent Centric Software adopts an alternative lawful data export mechanism for theTransfer of Customer’s Personal Data not described in this DPA (“Alternative Transfer
Mechanism”), the Alternative Transfer Mechanism shall apply instead of any applicable transfer
mechanism described in this DPA.

19
Centric Software DPA 2023