[Avaya CLM Agreement Number and Name here ]Addendum 2

DATA PROCESSING ADDENDUM(FOR AVAYA SUPPLIERS)
This Data Processing Addendum (“DPA”) is an integral part of the ______________(note to delete: i.e.Master Relationship Agreement)(“Agreement”) between Avaya and Supplier, which incorporates them by reference.
The parties acknowledge and agree that (i) when Avaya is acting as a Data Controller, Supplier will be a Data Processor acting on
behalf of Avaya, and (ii) when Avaya is acting as a Data Processor on behalf of Controller Customers, Supplier will be acting as
Avaya’s Sub-Processor.
This DPA applies to all activities related to the Agreement and in which employees of Supplier or Data Sub-Processors commissioned
by Supplier Process Personal Data on behalf of Avaya and/or Customer Controllers, as applicable. It contains, in conjunction with
the Agreement, the documented instructions for the Processing of Personal Data, as well as the subject-matter, duration, nature,
purpose of the Processing, and shall govern the rights and obligations of the parties in connection with the Processing of PersonalData.
Articles (i.e., 1, 3, 4, 8, 12) of this DPA also apply to the Processing of Non-Personal Data.

1.

Definitions

1.1

For the purpose of this DPA (i) “Personal data” means any information relating to an identified or identifiable natural person(“Data Subject”) or household; an identifiable natural person is one who can be identified, directly or indirectly, in particular
by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or morefactors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; (ii)
“Processing”, “Process”, “Processed” means any operation or set of operations which is performed on Personal Data and/orNon-Personal Data or on sets of personal data, whether or not by automated means, such as collection, recording,organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission,
dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction; (iii) “DataController” means the natural or legal person, public authority, agency or other body which, alone or jointly with others,
determines the purposes and means of the processing of Personal Data; (iv) “Data Processor” means a natural or legal
person, public authority, agency or other body which processes Personal Data on behalf of and per the instructions of a Data
Controller; (v) “Data Sub-Processor” means a third party engaged by Supplier (including without limitation an Affiliate and/or
a third party sub-contractor of Supplier) in connection with the Processing of Personal Data; (vi) “Non-Personal Data” meansdata other than Personal Data that is subject to confidentiality obligations under the Agreement; (vii) “Sell” means any sharing
or disclosure of Personal Data to a third party in exchange for monetary or other valuable consideration; (viii) “SecurityBreach” any actual or alleged data security breach or incident, in particular in each case of destruction, loss, alteration,
unauthorised or accidental disclosure of or access to any Personal Data and/or Non-Personal Data or other breach of thisDPA by Supplier or any of its staff, Data Sub-Processors or any other identified or unidentified third party; (ix) “CustomerControllers” means, including, but not limiting to, Avaya Affiliates, Avaya Resellers, or Avaya end-user customers, asapplicable, to the extent that such parties are deemed to be Data Controllers of the Personal Data processed by Supplier; (x)“Model Clauses” mean appropriate Standard Contractual Clauses specified in Section 6.2.

1.2

Capitalised terms used in this DPA that are not defined in Section 1.1 or elsewhere in this DPA, shall have the meaning setout in the Agreement.

2.

Processing of Personal Data

2.1

Any Processing of Personal Data by Supplier under this DPA shall occur only:

2.1.1

on behalf of Avaya (including when Processing is initiated by Customer Controllers); and2.1.2

in accordance with the Agreement and applicable data protection law; and2.1.3

for the purpose of fulfilment of Avaya’s instructions in connection with the provision of Solution(s) under the Agreement.

2.2

Without limiting the generality of Sub-Sections 2.1.1 to 2.1.3, Supplier agrees that it shall not: (i) Sell any Personal Data; (ii)retain, use, or disclose the Personal Data for any purpose other than as necessary to provide the Solution(s) set forth in theAgreement, including retaining, using, or disclosing the Personal Data for a commercial purpose other than as necessary toprovide the Solution(s) set forth in the Agreement; (iii) retain, use, or disclose the Personal Data outside of the direct business
relationship between Avaya and Supplier.

2.3

This DPA and the Agreement are Avaya’s complete instructions at the time of signature of this DPA to Supplier for theProcessing of Personal Data. However, such instructions may be amended, supplemented or replaced by Avaya indocumented form at any time (new instruction). If such new instructions from Avaya exceed the scope of the Agreement, theyshall be considered as request to amend the Agreement.

2.4

Supplier shall monitor the fulfilment of its obligations as per Section 2.1 regularly and demonstrate its compliance to Avaya in

Revision Approved: V1.22_DPA & Annex 1
11.April.2022
Avaya - Proprietary. Use pursuant to your signed agreement or Avaya policy

Page 1 of 5

[Avaya CLM Agreement Number and Name here ]writing within twenty (20) days of a request.

2.5

Supplier will Process Personal Data for the duration of the order and/or statement of work, as applicable, made pursuant tothe Agreement, unless otherwise agreed upon in writing or required by applicable law.

2.6

The subject-matter, nature and purpose of the Processing of Personal Data on behalf of Avaya and/or Customer Controllers
within the scope of this DPA result from the Agreement and may be further specified in the Agreement and/or Annex 1 (if any)
to this DPA.

2.7

The categories of Data Subjects affected by the Processing of Personal Data on behalf of Avaya and/or Customer Controllers
within the scope of this DPA result from the Agreement and may include (but is not limited to) employees, agents, advisors,freelancers and business partners of Avaya (who are natural persons), natural persons (employees, customers, etc.) ofCustomer Controllers, etc. Categories of Data Subjects may be further specified in the Agreement and/or Annex 1 (if any) tothis DPA.

2.8

The categories and types of Personal Data affected by the Processing of Personal Data on behalf of Avaya and/or Customer
Controllers within the scope of this DPA result from the Agreement and, in particular, from Avaya’s and/or its Customer
Controllers’ individual usage of (and input into) the Solutions provided by the Supplier and may include (but is not limited to)name (first name, last name), contact information (company, title / position, email address, phone number, physical address),connection data (IP address), video / call (recordings) data, and metadata derived thereof, etc. Categories and types of
Personal Data may be further specified in the Agreement and/or Annex 1 (if any) to this DPA.

3.

Supplier’s personnel

3.1

Supplier shall:

3.1.1

ensure all employees involved in Processing of Personal Data and/or Non-Personal Data on behalf of Supplier havecommitted themselves to confidentiality in writing, are prohibited from Processing Personal Data and/or Non-Personal Data
without authorization, have received appropriate training on their responsibilities;

3.1.2

ensure the access to Personal Data and/or Non-Personal Data is limited to the personnel necessary to execute Supplier’s
obligations under the Agreement;

3.1.3

monitor the fulfilment of his obligations as per Sub-Sections 3.1.1 and 3.1.2 regularly and demonstrate its compliance toAvaya in writing within twenty (20) days of request.

3.1.4

appoint a country / global data protection officer, to the extent required by the applicable law, and provide his / her contact
details on request to Avaya in writing.

4.

Security of Processing

4.1

Supplier has implemented and shall maintain appropriate technical and organizational measures (that at a minimum complywith the measures listed in Addendum 1 (TOMs), which is incorporated herein by reference) for the Processing of Personal
Data and/or Non-Personal Data on behalf of Avaya. Supplier shall ensure a level of security appropriate to the risks that arepresented by the Processing, taking into account the risk of varying likelihood and severity for the rights and freedoms ofnatural persons. Supplier shall regularly test, assess and evaluate the effectiveness of such technical and organizational
measures for ensuring the security of the Processing.

5.

Data Sub-Processors

5.1

The use of third-party Data Sub-Processors by Supplier (including further sub-processors of its Data Sub-Processors) issubject to specific prior written authorization from Avaya.

5.2

The use of Supplier’s Affiliates (as Data Sub-Processors) by Supplier is subject to general written authorization from Avaya.
Avaya hereby declares its general consent to the usage of Supplier’s respective Affiliates as Data Sub-Processors. Suppliershall provide Avaya with a list of its Affiliates used as Data Sub-Processors and shall notify Avaya in writing in advance incase of any changes. Avaya shall have the right to object to the use of any new Data Sub-Processors within 2 (two) weeks
following the notification.

5.3

Supplier shall impose the same data protection obligations on any further Data Sub-Processors in writing as set out in thisDPA (in particular providing sufficient guarantees to implement appropriate technical and organizational measures). Suppliershall be liable for the acts and omissions of its Data Sub-Processors to the same extent Supplier would be liable if performing
the services of each Data Sub-Processor directly under the terms of this DPA.

6.

International Transfers of Personal Data

6.1

Supplier shall comply with all applicable data privacy laws regarding the international transfers of Personal Data.

6.2

Furtherdetailsonapplicableinternationaltransfercompliancemechanismareavailableat
https://www.avaya.com/en/documents/requirements-of-international-transfers-of-personal-data.pdf (updated from time totime if required by law) and shall be deemed to have been incorporated herein by reference.

7.

Requests from Data Subjects

Revision Approved: V1.22_DPA & Annex 1
11.April.2022
Avaya - Proprietary. Use pursuant to your signed agreement or Avaya policy

Page 2 of 5[Avaya CLM Agreement Number and Name here ]7.1

Supplier shall, in accordance with applicable laws, promptly notify Avaya if Supplier receives a request from a Data Subject
to exercise his rights (such as: right of access, right to rectification, restriction of Processing, erasure (“right to be forgotten”),
data portability, object to Processing, right not to be subject to an automated individual decision making, etc.) connected to
the Processing under the Agreement and this DPA. Supplier shall cooperate and assist Avaya in ensuring compliance withAvaya’s obligations to respond to such requests.

8.

Notification and incidents

8.1

Supplier shall:

8.1.1

Immediately notify Avaya of any Security Breach;

8.1.2

Promptly provide Avaya with full cooperation and assistance in respect of any Security Breach and all information in Supplier's
possession concerning the Security Breach, including, but not limited to, the following: (i) the possible cause andconsequences of the breach; (ii) the categories of Personal Data and/or Non-Personal Data involved; (iii) a summary of thepossible consequences for the relevant Data Subjects; (iv) a summary of the unauthorised recipients of Personal Data and/or
Non-Personal Data; and (v) the measures taken by Supplier to mitigate any related risk and / or loss or damage or (potentialloss or damage);

8.1.3

Take all necessary and appropriate corrective actions, including as may be instructed by Avaya and applicable privacy laws
and regulations, to remedy or mitigate any Security Breach at Supplier’s sole cost and expense.

8.1.4

Not make any announcement or publish or otherwise authorise any broadcast of any notice or information about a Security
Breach (the "Breach Notice") without the prior written consent from Avaya; and prior written approval by Avaya of the content,
media and timing of the Breach Notice.

8.2

In case of reporting and notification obligations of Avaya to competent data protection supervisory authorities and / or affected
Data Subjects resulting from a Security Breach in connection with the Personal Data being Processed by Supplier, theSupplier shall, upon request, provide support to Avaya to comply with these obligations, taking into account the nature of theProcessing and the information available to Supplier. The same applies in the event of any reporting or consultation obligationsof Avaya to the competent data protection supervisory authorities in connection with an intended Personal Data Processing,which bears an increased risk for the rights and freedoms of concerned Data Subjects.

8.3

Supplier shall inform Avaya about audits or similar measures of a competent supervisory authority, if Personal Data inconnection with this DPA is affected. This also applies if a competent data protection authority commences investigations at
Supplier due to a breach of data protection regulations in connection with this DPA.

9.

Assistance

9.1

Upon written request of Avaya, Supplier shall assist Avaya without undue delay in ensuring compliance with obligations thatderive from relevant privacy laws and are applicable to Avaya (and/or its Customer Controllers) with regards to implementing
appropriate technical and organizational measures to ensure an appropriate level of security, conducting assessments of theimpact of the envisaged Processing operations on the protection of Personal Data (e.g., Data Protection Impact
Assessments), consultation procedures with supervisory authorities (e.g., Prior Consultation), etc., taking into account thenature and risk of the Processing and the information available to Supplier.

10.

Return and deletion of Personal Data

10.1

Personal Data (including any copy of it) shall not be kept longer than is required for the Processing purposes, unless (i) alonger retention period is required by applicable law or (ii) Avaya instructs Supplier in writing to (a) keep certain Personal Datalonger or (b) return certain Personal Data earlier.

10.2

The return of any data storage medium provided by Avaya to Supplier shall be conducted without undue delay (i) aftertermination / expiration of the Processing activity or (ii) earlier as instructed by Avaya.

11.

Audits11.1

On written request of Avaya, Supplier shall provide Avaya without undue delay with any reasonable information requested toeffectively monitor the compliance with this DPA and the Agreement.

11.2

Avaya (and/or any third party on Avaya’s behalf) and/or Customer Controllers may audit Supplier’s compliance with the termsof this DPA and the Agreement at any time. This may include, but is not limited to, access to Supplier’s data Processing
facilities, data files and documentation relevant for the Processing activities stipulated in this DPA and/or the Agreement.

12.

Miscellaneous

12.1

Without prejudice to any other obligations under this DPA or the Agreement, Supplier will provide all Personal Data and/or
Non-Personal Data Processing activities (i) with reasonable care and skill, and (ii) in accordance with good industry practiceand applicable privacy laws and regulations.

12.2

Supplier hereby indemnifies Avaya for all claims, actions, costs, expenses and damages (including without limitation
reasonable attorney's fees and costs) suffered by Avaya as a result of Supplier's failure to comply with this DPA or applicable

Revision Approved: V1.22_DPA & Annex 1
11.April.2022
Avaya - Proprietary. Use pursuant to your signed agreement or Avaya policy

Page 3 of 5

[Avaya CLM Agreement Number and Name here ]privacy laws and regulations. Any disclaimers or limitations of liability including, but not limited to, those contained in theAgreement do not apply in the event Supplier is not compliant with this DPA or applicable privacy laws and regulations.

12.3

The term of this DPA corresponds to the term of the Agreement. The clauses of this DPA and obligations which by their nature
are intended to survive termination or expiration of this DPA will continue and survive any termination or expiration of thisDPA.

12.4

Notwithstanding anything to the contrary in the Agreement, in the event of a conflict between the terms of this DPA and theterms of the Agreement, the terms of this DPA shall prevail. In case of a conflict between (i) the Model Clauses and (ii) thisDPA or the Agreement, the Model Clauses shall prevail.
(REMAINDER OF PAGE INTENTIONALLY LEFT BLANK)

Revision Approved: V1.22_DPA & Annex 1
11.April.2022
Avaya - Proprietary. Use pursuant to your signed agreement or Avaya policy

Page 4 of 5

[Avaya CLM Agreement Number and Name here ]Addendum 2

DATA PROCESSING ADDENDUMAnnex 1
DATA PROCESSING FORM

(Note to Daft: to be customized by the Avaya DPO provided that the Supplier will be Processing Personal
Data originating from the European Economic Area / the United Kingdom / Switzerland; otherwise - delete).
1.

Solutions to be provided to Avaya for:the internal use (Avaya shall be treated as a Data Controller)
the benefit of Customer Controllers (Avaya shall be treated as a Data Processor)

2.

Full legal name and address of the Supplier:Specified in the Agreement.

3.

Full legal name and address of Avaya:
Specified in the Agreement.

4.

Subject matter, nature and purpose of the Processing:5.

Categories of affected Data Subjects:

6.

Categories and types of Personal Data affected:

7.

Categories of sensitive Personal Data and applied restrictions and safeguards to protect them in case of international datatransfers:8.

The period for which the Personal Data will be retained, or, if that is not possible, the criteria used to determine that period:
Specified in Section 2.5. of the DPA.
9.

In case of third country transfers – frequency of the transfer (e.g., whether the Personal Data is transferred on a one-offor continuous basis):

10. In case of third country transfers – purpose of the transfer and further processing:
11. If Supplier uses third party Data Sub-Processors – list of such Data Sub-Processors of the Supplier (including full legal
name, country of incorporation, description, subject-matter, nature of the Processing, Processing locations / Countries ofProcessing):
Authorized third Party Data Sub-Processors (subject to Section 5.1. in the DPA):
Full legal
nameCountry ofincorporation

Description, subject-matter, nature of theProcessing

Processing location(-s) / Country(-ies)of Processing

12. Supplier’s contact person, position and contact details (postal address and email) for data privacy related matters:

13. Contact details of Avaya Data Privacy Office:Avaya UK, Building 1000, Cathedral Square, Cathedral Hill, Guildford, Surrey GU2 7YL, United Kingdom,
dataprivacy@avaya.com.
(REMAINDER OF PAGE INTENTIONALLY LEFT BLANK)

Revision Approved: V1.22_DPA & Annex 1
11.April.2022
Avaya - Proprietary. Use pursuant to your signed agreement or Avaya policy

Page 5 of 5