For Contracts & Purchase Orders effective after July 1, 2024
Kodak Data Processing Agreement
Supplier agrees that it shall comply with the following provisions with respect to all “Personal Information” collected, used,transmitted or maintained for Eastman Kodak Company and its affiliates (collectively, “Kodak”). This Data Processing Agreement (the “DPA”) stipulates privacy, confidentiality, and security requirements and demonstrates compliance with applicableprivacy, security and data protection laws.
1.

Definitions.
(a) “AI Technology” means any products, services or features that utilize machine learning software, algorithms, hardware or other artificial intelligence tools or aids to generate information or make predictions, recommendations, ordecisions.
(b) “Agreement” means any services agreement between Kodak and Supplier pursuant to which Supplier Processes any
Personal Information for or on behalf of Kodak. “Agreement” encompasses all agreements, contracts, statements ofwork (SOWs), purchase order terms and/or online terms and conditions between Kodak and Supplier.
(c) “CA Privacy Law” means (collectivity) the California Consumer Privacy Act, the California Privacy Rights Act, and allissued implementing regulations, as and when effective, and any other applicable California state privacy laws.
(d) “Data Subject Request” means any request by an individual (or by another person acting on behalf of an individual)
to exercise a right under any Privacy Law, or any other complaint or inquiry or similar communication about the Processing of the individual’s Personal Information.
(e) “Deidentified” means that (i) the Personal Information has all Direct Identifiers removed, (ii) the individuals cannot
reasonably be identified using indirect identifiers or other information available to the Supplier, and (iii) the Supplier
has a formal program containing administrative and technical controls that are reasonably designed to ensure thatthe resulting data are not re-identified or otherwise used in an identifiable manner by Supplier or any third party. For
purposes of this definition, a “Direct Identifier” is any single data element that could reveal a person’s identity, suchas a person’s name, username or online identifier, email address, physical address or geolocation, telephone number,device or vehicle identifier, birthdate, transaction date, identification number (such as a government-issued ID number or account number) payment card number, IP address, biometric identifier, photograph or other image that allows individual identification.
(f)“EEA Personal Data” means that subset of Personal Information consisting of personal data (as defined in GDPR) pertaining to residents of the European Economic Area (EEA), Switzerland and the United Kingdom.

(g) “GDPR” means Regulation (EU) 2016/679, the General Data Protection Regulation and all issued implementing regulations, as and when effective.
(h) “Internal Business Purposes” means processing of Personal Information by Supplier to (i) comply with its own legal
or regulatory obligations; (ii) make back-ups as part of disaster recovery and business continuity programs; (iii) retain
and manage Subprocessors, (iv) build and improve the quality of the Services, inducing debugging to identify andrepair errors that impair intended functionality of its products and for product development, provided that Supplierdoes not use Kodak Information to provide services to other companies or to create profiles of individuals (otherthan for Kodak); and (v) prevent, detect or respond to security incidents or malicious, deceptive, fraudulent, or illegal
activity.
(i)“Kodak Information” means all Personal Information processed by Supplier in connection with the Services.

(j)“Personal Information” means all data (regardless of format) that (i) identifies or can be used to identify, contact or
locate a natural person, (ii) pertains in any way to an identified natural person, or (iii) falls within any definition of“personal information” or “personal data” under any applicable Privacy Law. Personal Information includes obvious
identifiers (such as names, addresses, email addresses, phone numbers and identification numbers) as well as biometric data, “personal data” (as defined in the GDPR) and any and all information about an individual’s computer ormobile device or technology usage, including (for example) IP address, MAC address, unique device identifiers,
unique identifiers set in cookies, and any information passively captured about a person’s online activities or device
location.

(k) “Privacy Laws” means all applicable laws that regulate the Processing of Personal Information. In particular, the Privacy Laws may include (as applicable) the CA Privacy Law, the GDPR, and other applicable US Federal, state, and international laws and regulations that specify privacy, data protection, security or security breach notification obligations or that otherwise regulate the Processing of the Kodak Information or the provision of the services by Supplier.
(l)“Processing” means any operation or set of operations which is performed upon Personal Information, whether or
not by automatic means, such as collection, compilation, use, disclosure, duplication, organization, storage, alteration, Transfer, transmission, combination, redaction, erasure, or destruction.

(m) “Restricted Transfer” means any Transfer where the applicable Privacy Law requires the parties to demonstrate adequate
protection using a standard contractual instrument or other prescribed means. Restricted Transfers do not include Transfers to recipients in countries whose data protection regimes have been declared adequate by relevant data protection
authorities or which are otherwise not restricted.
(n) “Security Breach” means a “personal data breach” (as defined in the GDPR), a “breach of the security of a system” orsimilar term (as defined in any other applicable Privacy Law), any unauthorized use or disclosure of Kodak Information or any other event that compromises the security, confidentiality, availability or integrity of Kodak Information, including reidentification of any Deidentified data.
(o) “Services” means all services Supplier provides to or performs for Kodak under an Agreement. Services encompasses
the processing services as well as any products, websites, applications, devices or technologies used in connection
with the provision of the Services.
(p) “Standard Contractual Clauses” means (as applicable) the contract terms set forth in the Annex to the European Commission’s decision C(2021) 3972 of 4 June 2021 containing Standard Contractual Clauses for the transfer of personal
data to third countries pursuant to Regulation (EU) 2016/679 (the “EU SCCs”) or (ii) other contract terms published byrelevant regulatory authorities to authorize data Transfers.
(q) “Subprocessor” means any entity (including an affiliate of Supplier) that provides any services to Supplier and that may
have access (including inadvertent access) to any unencrypted Kodak Information.
(r)“Supplier Security Standard” means Kodak’s minimum information security requirements for Kodak Information foundat Kodak-Supplier-Security-Requirements.pdf. The Supplier Security Standard is an integral part of this DPA.

(s) “Transfer” means to disclose or otherwise make the Personal Information available to a third party (including to any affiliate or Subprocessor of Supplier), either by physical movement of the Personal Information to such third party or byenabling access to the Personal Information by other means.
2.

General Obligations.
(a) Supplier shall only Process or Transfer Kodak Information as authorized by Kodak in writing, as needed for its Internal Business Purposes, and as necessary to perform the Services. The Appendix below contains a general descriptionof the Processing activities and Services. Supplier may periodically update the Appendix and provide the updated
version to Kodak as needed to inform Kodak of any changes, including any changes to the privacy and security contacts, Subprocessors and/or Transfers.

Page 2

(b) Unless otherwise prohibited by the Agreement or any applicable Privacy Law, Supplier may also further Process Kodak Information as needed to Deidentify it and aggregate it with other Kodak or third party data to create datasetsfor other internal operational purposes such as research, product development and analytics. To extent these setscontain any unique record identifiers, indirect identifiers or otherwise continue to be regulated by the Privacy Laws,
Supplier will comply with provisions of applicable Privacy Law and continue to handle the data in accordance withthis DPA.
(c) Supplier will not (i) sell the Kodak Information or share the Kodak Information with third parties for online targeting,(ii) retain, use or disclose the Kodak Information other than as specified in the Agreement, (iii) retain, use or disclose
the Kodak Information outside of its direct business relationship with Kodak.
(d) Supplier shall promptly inform Kodak in writing: (i) if it cannot comply with any material term of its agreement with
Kodak regarding the Services (if this occurs, Supplier shall use reasonable efforts to remedy the non-compliance,
and Kodak shall be entitled to terminate Supplier’s further Processing of Kodak Information); (ii) of any request foraccess to any Kodak Information received from an individual who is (or claims to be) the subject of the data; (iii) of
any request for access to any Kodak Information received by Supplier from any government official (including any
data protection agency or law enforcement agency) unless it is explicitly prohibited by law from notifying Kodak of
the request; (iv) of any other requests with respect to Kodak Information received from Kodak’s employees or otherthird parties, other than those set forth in the agreement. Supplier understands that it is not authorized to respondto these requests, unless explicitly authorized by Kodak or the response is legally required under a subpoena or similar legal document issued by a government agency that compels disclosure by Supplier.
(e) Each party must use reasonable efforts to stay informed of the legal and regulatory requirements for its Processingof Personal Information. Supplier’s Processing shall comply with all Privacy Laws that are applicable to the Processing, as well as Supplier’s own privacy notices. Supplier will promptly notify Kodak if, in its opinion, the instructions given by Kodak for Processing violate any law.
(f)

Supplier shall reasonably cooperate with Kodak and with its affiliates and representatives in responding to Data Subject Requests and/or regulatory inquiries as needed for Kodak to demonstrate compliance with the Privacy Laws
applicable to it and to respect individuals’ rights under such Privacy Laws. Supplier will reasonably assist Kodak withany data protection impact assessments and prior consultations with regulators as needed to comply with the Privacy Laws.

(g) In the event of any conflict between the terms of this DPA and the Agreement, the terms of this DPA will control
unless the Agreement explicitly indicates that an exception exists.
3.

Specific Compliance Requirements. To the extent applicable:(a) If the Kodak Information includes any Personal Information subject to the CA Privacy Laws, Supplier will comply withall applicable sections of the CA Privacy Laws, including providing the same level of privacy protection as required by
Kodak, for example, by cooperating with Kodak in responding to and complying with consumers’ requests made pursuant to the CA Privacy Laws, and implementing reasonable security procedures and practices appropriate to the nature of the personal information to protect the personal information from unauthorized or illegal access, destruction,use, modification, or disclosure in accordance with California Civil Code section 1798.81.5. Supplier grants Kodak theright to take reasonable and appropriate steps to ensure that it uses the personal information collected pursuant to
the Agreement in a manner consistent with the Kodak’s obligations under the CA Privacy Laws, including (for example) by ongoing manual reviews and automated scans of the Supplier’s system and regular assessments, audits, orother technical and operational testing at least once every 12 months.
(b) If the Services involve the collection of Personal Information directly from individuals, Supplier will provide the individuals with a clear and conspicuous privacy notice, which notice shall either (i) be Kodak’s privacy notice, or (ii) be
Supplier’s privacy notice, provided that such notice must address any legal requirements for such notices in the jurisdictions where it is given, be translated into the languages used in connection with Supplier’s interaction with theindividuals, and indicate that Supplier is processing the data as a processor on behalf of its clients. All such notices
must be approved by Kodak in writing.

Page 3(c) If the Kodak Information will include “protected health information” as defined in the Privacy, Security and Breach
Notification Rules issued under the Health Insurance Portability and Accountability Act ("HIPAA"), Supplier and Kodak shall execute an appropriate Business Associate Agreement as required by HIPAA.
(d) If the Kodak Information includes “consumer health data” as defined in an applicable Privacy Law or other sensitive
Personal Information or special categories of data, the parties shall comply with the specific requirements for theProcessing of these data elements. Supplier shall restrict access to these data elements to those personnel whose
access is needed to provide the Services, and it shall only process these data elements in accordance with Kodak’s
specific binding instructions. Supplier shall reasonably assist Kodak as needed for Kodak to comply with its obligations under applicable Privacy Laws that regulate these data elements.
(e) If the Kodak Information will include any payment card information, Supplier shall comply with all applicable requirements of the Payment Card Industry Data Security Standard as published by the PCI Security Standards Council(https://www.pcisecuritystandards.org/pci_security/).
(f)

If the Kodak Information will include EEA Personal Data, Supplier and Kodak shall ensure adequate protection for the
EEA Personal Data. Each party shall comply with the provisions of GDPR and other Privacy Laws applicable to it, as a“controller” or a “processor” (as defined in GDPR). For any Restricted Transfers of EEA Personal Data, the parties shalldocument adequate protection for the EEA Personal Data using an approved data transfer mechanism in accordancewith Section 5 below.

(g) If the Kodak Information includes Personal Information subject to the Personal Information Protection Law of thePeople’s Republic of China (PIPL), each party will comply with applicable provisions of PIPL. For any Restricted Transfers of Chinese Personal Information, the parties will use an approved data transfer mechanism in accordance with
Section 5 below.
(h) If Supplier’s products, services or apps incorporate any AI Technology, Supplier will disclose its use of the AI Technology on Annex 1 below and describe the AI Technology with sufficient detail so that Kodak can assess the risks
and benefits of utilizing the AI Technology. Supplier represents that it has implemented reasonable and appropriate
controls to manage the AI Technology, including to reasonably ensure that the AI inputs and outputs are properly
permissioned, free of bias, and appropriate for the purposes for which they are provided to Kodak. Supplier will not
permit any Kodak Information to be used for training or retraining of any Supplier or Subprocessor models without
the prior express written permission of Kodak.
4.

Confidentiality and Data Access.
(a) Consistent with the confidentiality provisions of the Agreement, Kodak Information is considered Confidential Information of Kodak and Supplier must maintain all Kodak Information in strict confidence. Supplier may disclose Kodak
Information to its employees and contingent workers, but only to the extent such individuals require access to the Kodak Information to perform the Services.
(b) Prior to allowing any employee or contingent worker to Process any Kodak Information, Supplier shall (i) conduct anappropriate background investigation of the individual as permitted by law (and receive an acceptable response), (ii)require the individual to execute an enforceable confidentiality agreement (in a form acceptable to Kodak), and (iii)
provide the individual with appropriate privacy and security training. Supplier will also monitor its employees and contingent workers for compliance with the privacy and security program requirements.

5.

Data Transfers and Subprocessors.
(a) Supplier shall only Transfer Kodak information as authorized by Kodak in the Agreement and as permitted by applicable Privacy Laws. Additionally, as needed to provide the Services (and for any further processing described on the
Appendix) Kodak authorizes Supplier to make routine Transfers of Kodak Information in the normal course of business on its corporate systems to itself in other countries and to its affiliates, which are under common ownershipusing intercompany contracts containing Standard Contractual Clauses or approved binding corporate rules.

Page 4

(b) Supplier shall not Transfer the Kodak Information to any Subprocessors or other third parties unless it has been authorized by Kodak in the Agreement or otherwise in writing. Notwithstanding the preceding sentence, if permitted
by the Agreement and applicable Privacy Law, Kodak provides a general authorization for Transfers to those Subprocessors listed in the Appendix (as may be amended by the Supplier from time to time, as necessary to perform theServices), provided that the Supplier: (i) has conducted adequate due diligence on the Subprocessor to ensure that it
is capable of providing the level of protection for Kodak Data as is required by the Standard Contractual Clauses; (ii)has entered into a written contract with the Subprocessor that includes the Standard Contractual Clauses Module 3
provisions; and (iii) remains primarily liable to Kodak for the acts, errors and omissions of the Subprocessor, as if
they were Supplier's own acts, errors and omissions. Supplier represents and warrants that all Restricted Transfers of
Kodak Information to the Subprocessors are authorized using an approved mechanism. Kodak reserves the right toobject to any Subprocessor for good cause, and Supplier shall not allow Subprocessor to access Kodak Information
until such objection is resolved.
(c) The parties agree that: (i) to the extent that there are Restricted Transfers subject to the GDPR, the EU SCCs (Module2) available at https://www.kodak.com/go/scc shall govern the Transfers; (ii) To the extent that there are RestrictedTransfers subject to the UK General Data Protection Regulation, the EU SCCs as modified by the International Data
Transfer Addendum to the Standard Contractual Clauses available at https://www.kodak.com/go/eu-scc shall govern
the Transfers; and (iii) To the extent that there are Restricted Transfers subject to the Swiss Federal Act on Data Protection (FADP), the EU SCCs shall govern the Transfers. The parties adopt the GDPR standard for Swiss data andagree that references to “GDPR” in the EU SCCs shall be understood to also be references to the FADP and interpreted to permit data subjects in Switzerland to seek redress for their rights in Switzerland.
(d) Should any supervisory authority or court determine that the Transfer mechanism used herein is no longer an appropriate basis for Restricted Transfers, Supplier and Kodak shall promptly take all steps reasonably necessary todemonstrate adequate protection for the impacted information, using another approved mechanism. Supplier understands and agrees that Kodak may terminate the Transfers as needed to comply with the applicable Privacy Laws.
(e) Should other jurisdictions require specific contractual terms to enable Restricted Transfers, the parties shall use goodfaith efforts to execute these instruments as needed to comply with the applicable Privacy Laws. If permitted by law,
the parties agree that the terms of the new instruments will be automatically incorporated by reference into thisTransfer Agreement upon Kodak’s circulation of an amendment to this Transfer Agreement containing new schedules with the required transfer terms. Supplier will have thirty (30) days to object to the inclusion of the new schedules by giving Kodak written notice, in which case Kodak may terminate the Transfers as needed to comply with law.
6.

Information Security Requirements.
(a) If Supplier has provided Kodak with responses to Kodak’s Independent Service Provider Questionnaire (ISPQ), Supplier represents and warrants that all such responses and information were accurate, current and complete, in allmaterial respects.
(b) Supplier represents and warrants that its information security program meets or exceeds the requirements of theInformation Security Requirements for Kodak Data a copy of which is posted at http://www.kodak.com/go/hsesupplier.
(c) Supplier shall have implemented and documented appropriate business continuity and disaster recovery plans toenable it to continue or resume providing Services (including restoring access to the Kodak Information) in a timely
manner after a disruptive event. At appropriate intervals or as otherwise requested by Kodak, Supplier will provide a
copy of its written business continuity and disaster recovery plans to Kodak.
(d) Upon request, Supplier shall provide Kodak with information about the Supplier’s information security program. Allsuch information is Confidential Information of Supplier. Supplier shall also submit its data processing facilities foraudit, during Supplier’s reasonable business hours, which shall be carried out by Kodak (or by a qualified independent auditor) in a mutually agreeable manner (designed to validate Supplier’s controls against an established industry
standard such as ISO 27001) no more than ten (10) day after any such request. Supplier shall fully cooperate withany such audit. If any such audit reveals material gaps or weaknesses in Supplier’s security program, Kodak shall be

Page 5

entitled to terminate Supplier’s Processing of Kodak Information until such issues are resolved. Such audits may occur only once per year; provided however, that Kodak may audit at any time in the event of a security breach or suspected material violation by Supplier of its obligations under the Agreement. Supplier shall also cooperate with any
audits conducted by any regulatory agency that has authority over Kodak as needed to comply with applicable law.
(e) Supplier will promptly and thoroughly investigate all allegations of unauthorized access to, use or disclosure of the
Kodak Information. Supplier will notify Kodak within 24 hours upon discovery of any Security Breach. This notification must be made via email to WW-CISO-Mail@kodak.com. Supplier shall provide Kodak with all information about
the Security Breach reasonably needed by Kodak to assess its incident response obligations.
If the Security Breach results from either (i) the negligence or misconduct of Supplier (or any Supplier Subprocessor)or (ii) a failure of Supplier to comply with the terms of this Standard or its Agreement with Kodak, Supplier shall bear
all costs associated with resolving a Security Breach, including (without limitation), conducting an investigation, engaging appropriate forensic analysis, notifying individuals, regulators and others as required to by law or needed toaddress a real risk of harm, providing individuals with credit monitoring (or other appropriate remediation service),and responding to individual, regulator and media inquiries. The costs associated by Supplier for investigating andmitigating any Incident (including providing notifications and credit monitoring as set forth above) shall not be limited by the caps on Supplier liability set forth in the Agreement. Supplier’s other obligations with respect to liability
and indemnification will be governed by the terms of the Agreement.
(f)When the Supplier ceases to perform Services for Kodak (and at any other time, upon request), Supplier will either (i)return the Kodak Information (and all media containing copies of the Kodak Information) to Kodak, or (ii) purge, delete and destroy the Kodak Information. Upon request, Supplier will provide Kodak with an Officer’s Certificate tocertify its compliance with this provision. If Supplier is required by applicable law to retain any Kodak Information,
Supplier warrants that it shall (i) ensure the continued confidentiality and security of the Kodak Information, (ii) securely delete or destroy the Kodak Information when the legal retention period has expired, and (iii) not actively Process the Kodak Information other than as needed to comply with law.

(g) Supplier shall maintain appropriate cyber liability insurance to address the risks from its Processing of Personal Information, which shall include coverage for, but not limited to, network security liability and liability under Privacy
Laws including risks of cyber-attacks and security breaches.
***

Appendix – Annexes 1-3, General Description of the Processing Activities, Security Measures and Approved Subprocessors
Additional Attachments (only if needed)
Schedule 1 – Standard Contractual Clauses
Schedule 2 – UK Addendum[Schedules 3 et seq. – Other Transfers Clauses if needed]
HIPAA Business Associate Agreement

Page 6

Appendix to the Data Processing Agreement
This Appendix also serves as the Appendix to the Standard Contractual Clauses attached as Schedule 1,
if those are used to authorize cross-border data transfers as indicated below.
ANNEX I: General Description of the Processing Activities
A. LIST OF PARTIES
Eastman Kodak Company as Data Exporter or Transferor
Name: Eastman Kodak Company
DPO: Kodak Privacy Office
Address: Eastman Kodak Company, Privacy Office, 13th Floor, Building 7, 343 State Street, Rochester, NY 14650
Address 2: Kodak GmbH, Data Privacy, Kesselstrasse 19, 70327 Stuttgart, Germany
Privacy Contact: privacy@kodak.com or https://www.kodak.com/go/eearesidents
Kodak Information Security Contact: WW-CISO-Mail@kodak.com
Kodak Contact for Data Breach Reporting: WW-CISO-Mail@kodak.com
Supplier as Data Importer or Transferee
Name:
DPO:
Address:
Contact person’s name, position, and contact details:
Supplier Information Security Contact:
B. DESCRIPTION OF THE PROCESSING AND TRANSFER – (1) if the processing operations are complex, create multiple sections B (e.g., B1 for transfers related to service 1; B2 for transfers related to service 2, etc.) (2) For EEA data, if you use both Module 2 and 3, be sure to indicate which transfers are subject to each Module.
Categories of data subjects whose personal data are processed and/or transferred☐ Consumer customers☐ Prospective consumer customers, website visitors☐ Professionals☐ Commercial customers (e.g., company employees)☐ Prospective commercial customers, B2B leads, trade show attendees☐ Job Applicants☐ Employees, contractors, dependents/family☐ Suppliers☐ Children [or] Students☐ Patients☐ Other
Categories of personal data are processed and/or transferred☐ Individual contact information (names, addresses, email addresses, etc.)
Page 7

☐ Unique identifiers (government identification numbers, customer numbers, etc.)☐ Information pertaining to consumer transactions (purchase details, etc.)☐ Information pertaining to commercial transactions☐ Human resources data
☐ Customer relationship information (demographic data, preferences etc.)☐ Online and technical information (device data, IP addresses, sensor data etc.)☐ Inferred or derived information (analytics data, propensities etc.)☐ Video and/or audio recordings☐ Data in connection with[e.g., online advertising targeting, compliance hotline, health & safety, etc.)☐ Sensitive data – see below☐ Other
Sensitive data processed and/or transferred (if applicable)☐ Government-issued identification numbers, national identification numbers☐ Financial account numbers, including payment card data and insurance account numbers☐ Health data, medical information or genetic information☐ Biometric data
☐ Consumer reports, including employee background screening reports, investigation reports or credit reports☐ Online account access information, including usernames, passwords, security questions/answers☐ Precise geolocation data
☐ Contents of a person’s communications (unless the Supplier is the intended recipient of the communications)☐ Data related to criminal convictions or offenses or allegations of crimes☐ Special categories of data that reveal race or ethnicity, political opinions, religious or philosophical beliefs, tradeunion membership, health, or sex life or sexual orientation
Additional information about the processing – indicate if the personal information includes:☐ EEA Personal Data
☐ Personal Information subject to the CA Privacy Law☐ Protected Health Information subject to HIPAA [Add Business Associate Agreement]☐ Data pertaining to children under 16 years old☐ Other:[e.g., specially regulated data]
Nature of the processing
Provide a brief overview of the Services and the purposes for which the Personal Information will be processed.
AI Transparency Statement
Will the Services include any AI-facilitated processing activities? ☐ Yes ☐ No
If yes, provide a brief overview or link to a published AI Transparency Statement

Physical Location of the Personal Information
Indicate where the processing is carried out and where the Kodak Data are stored.
The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that
period.
Describe☐ Kodak Information will be deleted automatically upon termination of the Agreement☐ Kodak Information will be deleted upon termination of the Agreement if requested by Kodak☐ Kodak Information will be retained after termination for[period]
Indicate data retention rules and controls that exist to prevent further Processing of the Kodak Data by the Supplier and the Subprocessors (if any).

Page 8

Maximum Retention periods, if applicable:
Category of Personal Data

PurposeRetention Period

Restricted Data Transfers☐ Data are not transferred
Purpose(s) of the data transfer
Describe
The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis).
☐ One-off☐ Continuous or Periodic☐ Ad hoc, as needed for the processing activity☐ Other:
Basis for the transfer of EEA Personal Data:☐ Standard Contractual Clauses attached as Schedules 1 and 2.
☐ Supplier has approved set of Binding Corporate Rules for Data Processors.
☐ Other basis:
Basis for other Restricted Transfers, e.g., Argentina, New Zealand (for further processing), Brazil, China, et al.
List Key Countries if applicable and reference added schedules.
For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing
See Annex 3 below.
C. COMPETENT SUPERVISORY AUTHORITY FOR RESTRICTED TRANSFERS
Restricted Transfer

Competent Supervisory Authority & Governing Law

EEA Transfers – per Schedule 1

INDICATE EEA AUTHORITY AND COUNTRY

Swiss Transfers

Federal Data Protection & Information Commissioner(FDPIC) – Switzerland

UK Data Transfers – per Schedule 2

Information Commissioner (ICO) – United Kingdom

Add rows if needed for other jurisdictions

Page 9

ANNEX II: TECHNICAL AND ORGANISATIONAL MEASURES
EXPLANATORY NOTE FROM THE COMMISSON:
The technical and organisational measures must be described in specific (and not generic) terms. See also the general commenton the first page of the Appendix, in particular on the need to clearly indicate which measures apply to each transfer/set oftransfers.
Technical and organizational measures including technical and organisational measures to ensure thesecurity of the data.
Description of the technical and organisational measures implemented by the data importer(s) (including any relevant certifications) to ensure an appropriate level of security, taking into account the nature, scope, context and purpose of the processing,and the risks for the rights and freedoms of natural persons.
For transfers to (sub-) processors, also describe the specific technical and organisational measures to be taken by the (sub-) processor to be able to provide assistance to the controller and, for transfers from a processor to a sub-processor, to the data exporter.
Supplier should either attach its standard security schedule or else provide a link to where security information is posted online.
ANNEX III: LIST OF SUBPROCESSORS
Supplier should either complete the chart or else provide a link to where subprocessor information is posted online.
Kodak has authorised Supplier’s use of the following subprocessors:
Subprocessor
Name

Subprocessor
Address

Description of
the Services

Categories of PI

Location of theProcessing(list all)Transfer
Mechanism (if
EEA Data)

Page 10

SCHEDULE 1
STANDARD CONTRACTUAL CLAUSES

This document contains the clauses that can be used to authorize controller to processor transfers (MODULE TWO) with ageneral authorization for subprocessors.
https://www.kodak.com/go/scc

SCHEDULE 2
INTERNATIONAL DATA TRANSFER ADDENDUM TO THE EU COMMISSION STANDARD CONTRACTUAL CLAUSES
https://www.kodak.com/go/eu-scc

Page 11