10X GENOMICS DATA PROCESSING ADDENDUM
This Data Processing Addendum, including its Annexes (the “DPA”) supplements the 10x Genomics Cloud Service
Terms (available at https://www.10xgenomics.com/legal/cloud-terms-of-use) (the “Cloud Service Terms”), the
10x Genomics Terms and Conditions of Sale (available at https://www.10xgenomics.com/legal/legal-notices#10x-genomics-terms-and-conditions-of-sale) (the “Terms and Conditions of Sale”) and the Product Addendums(available at https://www.10xgenomics.com/legal-notices#product-addendums) (the “Product Addendum(s)”), as
updated from time to time and as applicable to Customer’s use of the services, or other agreement between Customer
or Buyer (hereinafter the “Customer”) and 10x Genomics, Inc., with registered offices at 6230 Stoneridge Mall
Road, 94588-3260 Pleasanton, California, USA (hereinafter “10x Genomics”) governing Customer’s use of theservices and as entered into between Customer and 10x Genomics (the Cloud Service Terms, the Terms andConditions of Sale and the applicable Product Addendum(s) or other agreement between Customer and 10x
Genomics is collectively referred to as the “Main Agreement”) when and insofar as any of the Applicable Data
Protection Laws (as defined below) applies to Customer’s use of the services as per the Main Agreement andprocessing of Customer Data. This DPA is hereby incorporated into the Main Agreement and is subject to the termsof the Main Agreement. Unless otherwise defined in this DPA, all capitalized terms used herein will have themeanings given to them in the Main Agreement.
This DPA will be deemed executed and accepted by the Customer by entering into the Main Agreement and will
be effective as of the date of the Main Agreement (the “Effective Date”). It will replace any prior data processing
agreements applicable to the respective services (as defined in the Main Agreement).
PREAMBLE
While rendering services as per the Main Agreement, 10x Genomics will process personal data with regard to which
the Customer acts as the controller or processor in terms of the applicable data protection laws (the “Customer
Data”).
The parties to this DPA recognize that data protection requirements apply to the processing of personal data. This
DPA applies where 10x Genomics processes personal data and acts as a processor or sub-processor (as applicable)
on behalf of Customer and where the processing of such personal data is subject to applicable privacy laws such as
the European Union General Data Protection Regulation (Regulation 2016/679 of the European Parliament and of
the Council on the protection of natural persons with regard to the processing of personal data and on the freemovement of such data) (the “GDPR”), all applicable data protection and privacy legislation in force from time totime in the UK including without limitation the mandatory clauses required by Article 28(3) of the retained EU law
version of the GDPR (the "UK GDPR"), the Data Protection Act 2018 (and regulations made thereunder) (“UKDPA 2018”), the Privacy and Electronic Communications Regulations 2003 (SI 2003/2426) as amended (the “UK
Data Protection Laws”), the Swiss Federal Act on Data Protection of 19 June 1992 as revised and updated fromtime to time (“FADP”), the California Consumer Privacy Act as updated by the California Privacy Rights Act(“CCPA”), the DIFC Data Protection Law No.5 of 2020, the Canadian Personal Information Protection andElectronic Documents Act 2000 and applicable provincial laws (“PIPEDA”), the Singapore Personal Data
Protection Act 2012 (No. 26 of 2012) (“PDPA”), the Japanese Act on the Protection of Personal Information(“APPI”), and/or other data protection and privacy laws and regulations in force from time to time in the applicablejurisdiction and applicable to the processing of personal data under the Main Agreement (collectively the“Applicable Data Protection Laws”).
The parties have agreed to enter into this DPA in order to specify the data protection obligations and rights of theparties in connection with 10x Genomics’ use of Customer Data to render the services under the Main Agreement.

1.

Definitions

1.1“10x Genomics Group” means 10x Genomics and any of its affiliated entities, i.e., any corporate entity
that, directly or indirectly, controls, is controlled by, or is under common control with 10x Genomics.

1.2“Commissioner” means the Information Commissioner (see Article 4(A3), UK GDPR and section 114,
UK DPA 2018);

10x Genomics, Inc. Data Processing Addendum, Version 1.0[combined DPA]

1.3

"FDPIC" means the Swiss Federal Data Protection and Information Commissioner (see Article 4 FADP);

1.4“SCCs” means (i) where the EU GDPR or the FADP applies, the contractual clauses annexed to theEuropean Commission's Implementing Decision 2021/914 of 4 June 2021 on standard contractual clauses
for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European
Parliament and of the Council (“EU SCCs”), and (ii) where the UK GDPR applies, the EU SCCs, together
with the UK Commissioner’s International Data Transfer Addendum to the EU SCC’s issued unders.119A(1) of the Data Protection Act 2018 (“UK Addendum”) or such alternative clauses as may beapproved by the UK from time to time ("UK SCCs").

1.5

The terms “personal data,” “data subject,” “processing,” “controller” and “processor” as used in thisDPA have the meanings given in the GDPR and/or other Applicable Data Protection Laws. Customer and
10x Genomics may assume corollary relationships under applicable data privacy laws and regulations(e.g., “business” and “service provider” under the CCPA or “consignee” and “consignor” under the APPI)
thus giving the effect that in this DPA controller may be read to include business or consignor andprocessor may be read to include service provider or consignee.

2.

Scope of Processing

2.1

10x Genomics shall process the Customer Data on behalf of and in accordance with the instructions of the
Customer within the meaning of Art. 28 GDPR or as otherwise required to do so by applicable law. The
Customer or Customer’s end-customer remains the controller and 10x Genomics shall process the data asprocessor or sub-processor of the controller. As between the parties, the Customer shall have sole
responsibility for the accuracy, quality, and legality of personal data and the means by which the Customer
acquired the personal data.

2.2

The categories of personal data processed pursuant to this DPA and the subject matter, nature and purposeof the processing, and the categories of data subjects, are as described in Annex 1 to this DPA. The durationof processing corresponds to the term of the Main Agreement.

2.3

10x Genomics reserves the right to anonymize or aggregate the Customer Data in such a way that it is nolonger possible to identify individual data subjects, and to use them in this form for the purpose of needsbased designing, developing and optimizing as well as rendering of the services agreed as per the Main
Agreement. The parties agree that Customer Data which has been anonymized or aggregated (according
to the above requirement) are not considered personal data under the Applicable Data Protection Laws,
and thus are no longer Customer Data for the purposes of this DPA and 10x Genomics may continue toprocess such information for the purposes set forth in this Section 2.3.

2.4

If Customer is a processor, Customer warrants to 10x Genomics that Customer’s instructions and actions
with respect to the processing of personal data by 10x Genomics, including its appointment of
10x Genomics as sub-processor and concluding this DPA (incl. SCCs as applicable), have been authorized
by the relevant third-party controller.

3.
3.1

Instructions
10x Genomics shall process the Customer Data in accordance with the written instructions of the Customer
as set out in the Main Agreement and this DPA, unless 10x Genomics is legally required under applicablelaw (or by a supervisory authority) to do otherwise. In the latter case, 10x Genomics shall inform theCustomer of that legal requirement (or requirement of the Commissioner or the FDPIC) before processing,2
10x Genomics, Inc. Data Processing Addendum[combined DPA]

unless that law (or a supervisory authority) prohibits such information on important grounds of public
interest.
3.2

4.
4.1

In case 10x Genomics is of the opinion that an instruction given by the Customer infringes this DPA, theMain Agreement or Applicable Data Protection Laws, 10x Genomics will after informing the Customer
accordingly be entitled to suspend the execution of the instruction until the Customer confirms the
instruction. The parties agree that the sole responsibility for the processing of the Customer Data inaccordance with the Customer’s instructions lies with the Customer as the controller.
10x Genomics Obligations
When processing personal data in its role as a processor or sub-processor, 10x Genomics shall:(a)implement appropriate technical and organizational measures to ensure a level of security
appropriate to the risks that are presented by the processing of personal data, in particular
protection against accidental or unlawful destruction, loss, alteration, unauthorized disclosure of,or access to personal data, taking into account the state of the art, the implementation costs andthe nature, scope, circumstances and purposes of the Customer Data, as well as the different
likelihood and severity of the risk to the rights and freedoms of the data subjects. Such measures
include, without limitation, the security measures set out in Annex 2 to this DPA (“Security
Measures”). Customer acknowledges that the Security Measures are subject to technical progressand development and that 10x Genomics may update or modify the Security Measures from time
to time, provided that such updates and modifications continue to comply with the statutory
requirements;(b)

ensure that only authorized persons have access to Customer Data and that any persons
10x Genomics authorizes to have access to Customer Data are under obligations ofconfidentiality;(c)insofar as the Customer is subject to a notification obligation under Applicable Data Protection
Laws due to a breach of the security of Customer Data processed by 10x Genomics leading to theaccidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to,
Customer Data, notify the Customer without undue delay upon becoming aware of such breachand provide the Customer with reasonable cooperation and assistance in respect of that breach,
including all reasonable information in 10x Genomics’ possession concerning such breach to theextent it affects Customer Data;(d)to the extent 10x Genomics is able to verify that a data subject is associated with the Customer,
promptly notify the Customer if it receives a request from a data subject to exercise any dataprotection rights (including rights of access, rectification or erasure) in respect of that data
subject’s personal data and provide reasonable assistance to Customer by virtue of technical andorganizational measures in responding to such request if the Customer does not have the ability
to address such request without 10x Genomics’ assistance. 10x Genomics shall not respond to adata subject request without the Customer’s prior written consent except to confirm that such
request relates to the Customer, to which the Customer hereby agrees;(e)following termination or expiry of the Main Agreement or completion of the service, delete all
personal data (including copies thereof) processed pursuant to this DPA as set out in Annex 1.B.
below, unless 10x Genomics is obligated by law to further store the Customer Data (although 10x
Genomics may keep documentations, which serve as evidence of the orderly and accurate
processing of Customer Data, also after the termination of the Main Agreement);

3
10x Genomics, Inc. Data Processing Addendum[combined DPA](f)taking into account the nature of processing and the information available to 10x Genomics,
provide such assistance to the Customer as the Customer reasonably requests in relation to
10x Genomics’ obligations under Applicable Data Protection Laws with respect to:(i)data protection impact assessments and, if necessary, subsequent consultations with thesupervisory authority (pursuant to Applicable Data Protection Laws, such as Art. 35, 36
GDPR and Art.°22, 23 FADP, respectively);(ii)

notifications to the supervisory authority under Applicable Data Protection Laws and/or
communications to data subjects by the Customer in response to any personal data
breach; and(iii)

the Customer’s compliance with its obligations under Applicable Data Protection Laws
with respect to the security of processing;provided that the Customer shall cover all costs incurred by 10x Genomics in connection with its
provision of such assistance.
5.

Sub-processors

5.1

The Customer grants 10x Genomics an authorization for the engagement as sub-processors of those entities
listed as of the Effective Date at the URL https://www.10xgenomics.com/sub-processor-list. In addition,
and without prejudice to Section 5.2, Customer generally authorizes the engagement as sub-processors ofother members of the 10x Genomics Group or third parties, to support the performance of the services
provided to Customer under the Main Agreement. In general, no authorization is required for theengagement of service providers that are concerned with the examination or maintenance of dataprocessing activities or systems by third parties or that involve other additional services, even if access to
Customer Data cannot be excluded, provided 10x Genomics takes reasonable steps to protect theconfidentiality of the Customer Data.

5.2

10x Genomics will add the names of new and replacement sub-processors to the list of sub-processors
indicated in section 5.1 above before those sub-processors commence processing of personal data. If
Customer objects to any new or replacement sub-processor, on reasonable grounds to be proved to 10x
Genomics and related to data protection, it shall notify 10x Genomics of such objections in writing withinten (10) days of notification and the parties will seek to resolve the matter in good faith. If 10x Genomics
is reasonably able to provide the service to the Customer in accordance with the Main Agreement without
using the sub-processor and decides in its discretion to do so, then Customer will have no further rights
under this clause 5.2 in respect of the proposed use of the sub-processor. If 10x Genomics, in its discretion,requires use of the sub-processor or is otherwise unable to satisfy Customer’s objection regarding the
proposed use of the new or replacement sub-processor, then Customer may terminate the applicable Main
Agreement, including this DPA, in accordance with the provisions of the Main Agreement and solely withrespect to the service(s) that will use the proposed new sub-processor for the processing of personal data.
If Customer does not provide a timely objection to any new or replacement sub-processor or does not
terminate the applicable Main Agreement in accordance with this clause 5.2, Customer will be deemed tohave consented to the sub-processor and to have waived his right of objection.

5.3

10x Genomics will ensure that each sub-processor it engages agrees, in substance, to the same dataprotection obligations as the ones imposed on 10x Genomics under the DPA. Subject to the limitations ofliability included in the Main Agreement, 10x Genomics agrees to be liable for the acts and omissions of
its sub-processors to the same extent 10x Genomics would be liable under the terms of the DPA if it
performed such acts or omissions itself.

4
10x Genomics, Inc. Data Processing Addendum[combined DPA]

6.

Audit and records

6.1

10x Genomics shall, in accordance with Applicable Data Protection Laws, make available to Customer
such information in 10x Genomics’ possession or control as Customer may reasonably request with a view
to demonstrating 10x Genomics’ compliance with the obligations of a processor under Applicable Data
Protection Laws in relation to its processing of personal data. Except where required otherwise by
Applicable Data Protection Laws or indications of non-compliance, such reasonable request must be inwriting and only at reasonable intervals.

6.2

10x Genomics may fulfil Customer’s right of audit under Applicable Data Protection Laws in relation topersonal data, by providing at the request of Customer suitable documentation (e.g., audit reports or othercertifications, etc.) demonstrating that 10x Genomics’ technical and organizational measures are sufficientand in accordance with an accepted industry standard.

6.3

If the information made available pursuant to clause 6.1 and clause 6.2 is insufficient, in Customer’s
reasonable judgment, to confirm 10x Genomics’ compliance with its obligations under this DPA or
Applicable Data Protection Laws, then Customer may request an onsite audit to verify 10x Genomics’
compliance with its obligations under this DPA, in particular the implementation of the technical andorganizational measures. Except where required otherwise by Applicable Data Protection Laws orindications of non-compliance, the Customer may only request onsite audits at reasonable intervals during
the term of this DPA.

6.4

The following additional terms shall apply to audits pursuant to clause 6.1 to 6.3, the Customer requests
without varying or modifying the SCCs or affecting any supervisory authority’s or data subject’s rights
under the SCCs, as applicable:(a) Following receipt by 10x Genomics of a written notice of a request for audit, 10x Genomics andCustomer will discuss and agree in advance on the reasonable start date, scope, duration of, andsecurity and confidentiality controls applicable to any audit. Whenever possible, evidence for such an
audit will be limited to the evidence collected for 10x Genomics’ most recent third-party audit.
(b) 10x Genomics may charge a fee (based on 10x Genomics’ reasonable costs) for any audit and will
provide Customer with further details of any applicable fee, and the basis of its calculation, in advanceof any such audit. Customer will be responsible for any fees charged by any auditor appointed by
Customer to execute any such audit. If Customer performs more than one audit pursuant to clause 6.1
to 6.3, per calendar year, 10x Genomics’ reserves the right to charge Customer for any costs incurredwith the performance of such second audit and any subsequent audits within the same calendar year,
on an “at-cost basis.”(c) 10x Genomics may object in writing to an auditor appointed by Customer to conduct any audit if theauditor is, in 10x Genomics’ reasonable opinion, not suitably qualified or independent, a competitorof 10x Genomics, or otherwise manifestly unsuitable. Any such objection by 10x Genomics will
require Customer to appoint another auditor or conduct the audit itself.
(d) The Customer is not entitled to get access to data or information about 10x Genomics’ othercustomers, cost information, quality control and contract management reports, or any otherconfidential data of 10x Genomics that is not directly relevant for the purposes of the audit as set out
in clause 6.1 above.

5
10x Genomics, Inc. Data Processing Addendum[combined DPA]

7.
7.1

Data transfers to third countries
Cross-Border Data Transfer. 10x Genomics (and its sub-processors) may process Customer Data which is
subject to Applicable Data Protection Laws outside of the European Economic Area (“EEA”), Switzerland
and the UK in respect of which Customer may be a controller (or processor on behalf of a third-party
controller, as applicable). The parties agree that any transfer of personal data protected by Applicable Data
Protection Laws from Customer to 10x Genomics shall be subject to the appropriate SCCs as follows:
(a)

(b)

(c)

in relation to personal data that is protected by the GDPR, the EU SCCs will apply completed asfollows:(i)

Module Two will apply where Customer is a controller and Module Three will apply
where Customer is a processor;(ii)

in Clause 7, the optional docking clause will apply;(iii)

in Clause 9, Option 2 will apply, and the time period for prior notice of sub-processorchanges shall be as set out in Clause 5.2 of this DPA;

(iv)

in Clause 11, the optional language will not apply;(v)

in Clause 17, Option 1 will apply, and the law of Germany shall apply;(vi)

in Clause 18(b), disputes shall be resolved before the courts in Munich, Germany;(vii)

Annex I of the EU SCCs shall be deemed completed with the information set out inAnnex 1 to this DPA; and(viii)

Annex II of the EU SCCs shall be deemed completed with the information set out inAnnex 2 to this DPA.

in relation to personal data that is protected by the FADP (as amended or replaced), the EU SCCs,
completed as set out above in clause 7.1(a) of this DPA, shall apply to transfers of such personaldata, except that:(i)the competent supervisory authority in respect of such personal data shall be the FDPIC(ii)

in Clause 17, the governing law shall be the laws of Switzerland;(iii)

references to “Member State(s)” in the EU SCCs shall be interpreted to refer to
Switzerland, and data subjects located in Switzerland shall be entitled to exercise andenforce their rights under the EU SCCs in Switzerland; and(iv)

references to the “General Data Protection Regulation,” “Regulation 2016/679” or“GDPR” in the EU SCCs shall be understood to be references to the FADP (as amended
or replaced).

in relation to personal data that is protected by the UK GDPR, the UK SCCs will apply completed
as follows:6
10x Genomics, Inc. Data Processing Addendum[combined DPA]

(d)

(e)

(i)

The EU SCCs, completed as set out above in clause 7.1(a) of this DPA, shall also apply
to transfers of such personal data, subject to sub-clause (B) below;(ii)

The UK Addendum shall be deemed executed between the transferring Customer and
10x Genomics (and the EU SCCs shall be deemed incorporated and amended as
specified by the UK Addendum in respect of the transfer of such personal data)
completed as follows:(A)

Table 1 shall be deemed completed with the relevant information set out inAnnex 1 to this DPA;

(B)

Table 2 shall be deemed completed with checkbox option one selected andreferring to the EU SCCs completed as set out above in clause 7.1(a) of this
DPA;

(C)

Table 3 shall be deemed completed with the relevant information set out inAnnex 1 and Annex 2 to this DPA;(D)

Table 4 shall be deemed completed with checkbox option one selected, suchthat the Importer may end the UK Addendum as set out in Section 19 of the
UK Addendum.

the following terms shall apply to the SCCs:(i)

Customer may exercise its right of audit under the SCCs as set out in, and subject to therequirements of, clause 6 of this DPA;

(ii)

10x Genomics may appoint sub-processors as set out in, and subject to the requirementsof, clause 5 of this DPA, and Customer may exercise its right to object to sub-processors
under the SCCs in the manner set out in clause 5.2 of this DPA;(iii)

a certification of deletion of personal data that as described in clause 8.5 and 16(d) of
the SCCs shall be provided by 10x Genomics to Customer only upon Customer's written
request;(iv)

for the purposes of clause 8.6(c) of the SCCs, personal data breaches will be handled inaccordance with clause 4.1(c) of this DPA; and(v)

with regard to liability under clause 12 of the SCCs, any claim brought under the SCCs
shall be subject to the terms and conditions of the Main Agreement;in the event that any provision of this DPA contradicts, directly or indirectly, the SCCs, the SCCs
shall prevail.

Should Customer seek to conduct an assessment of the adequacy of the SCCs for transfers of Customer
Data to 10x Genomics, 10x Genomics shall, to the extent reasonably possible, provide reasonableassistance to Customer for the purpose of any such assessment, provided Customer shall cover all costs
incurred by 10x Genomics in connection with its provision of such assistance.
7.2

U.S. Privacy Obligations. To the extent that 10x Genomics processes personal data that is subject to
CCPA, 10x Genomics: (i) shall not sell or share personal data; (ii) shall process personal data only to
7

10x Genomics, Inc. Data Processing Addendum[combined DPA]

provide the services and shall not process personal data for any other purpose, except as may be permitted
by Applicable Data Protection Laws; (iii) shall not process personal data collected by 10x Genomics
outside of the direct business relationship between the parties, except as may be permitted by Applicable
Data Protection Laws; (iv) shall not combine personal data received from Customer pursuant to this DPA
with personal data that 10x Genomics receives from or on behalf of another person, except as required toprovide the services.
7.3

8.

Alternative Transfer Mechanism. To the extent 10x Genomics adopts an alternative data export mechanism(including the EU/U.S. Data Privacy Framework Program or any new version of or successor to it) for thetransfer of personal data not described in this DPA ("Alternative Transfer Mechanism") and provided,
if necessary under Applicable Data Protection Laws, such Alternative Transfer Mechanism has been
issued, approved or recognized, as applicable, beforehand by the competent supervisory authority, theAlternative Transfer Mechanism shall – at the choice of 10x – apply, and Customer agrees to execute suchother and further documents and take such other and further actions as may be reasonably necessary togive legal effect to such Alternative Transfer Mechanism.
General

8.1

This DPA is without prejudice to the rights and obligations of the parties under the Main Agreement whichshall continue to have full force and effect. In the event of any conflict between the terms of this DPA andthe terms of the Main Agreement, the terms of this DPA shall prevail so far as the subject matter concerns
the processing of personal data.

8.2

To the extent permitted by Applicable Data Protection Laws, 10x Genomics’ liability under or inconnection with this DPA, including under the SCCs if applicable, is subject to the exclusions andlimitations on liability contained in the Main Agreement. In no event does 10x Genomics limit or exclude
its liability towards data subjects or competent data protection authorities.

8.3

Except where and to the extent expressly provided in the SCCs, if applicable, or required as a matter ofApplicable Data Protection Laws, this DPA does not confer any third-party beneficiary rights; it isintended for the benefit of the parties hereto and their respective permitted successors and assigns only,
and is not for the benefit of, nor may any provision hereof be enforced by, any other person.

8.4

This DPA and any action related thereto shall be governed by and construed in accordance with the laws
as specified in the Main Agreement, without giving effect to any conflicts of laws principles. The parties
consent to the personal jurisdiction of, and venue in, the courts specified in the Main Agreement.

8.5

If any provision of this DPA is, for any reason, held to be invalid or unenforceable, the other provisionsof the DPA will remain enforceable and the invalid or unenforceable provision will be deemed modified
so that it is valid and enforceable to the maximum extent permitted by law.

8.6

No modification of, amendment to, or waiver of any rights under the DPA will be effective unless inwriting and signed by an authorized signatory of each party.

8
10x Genomics, Inc. Data Processing Addendum[combined DPA]

Annex 1
Data Processing/Transfer Description
This Annex 1 forms part of the DPA and describes the processing that 10x Genomics will perform on behalf ofCustomer.
A.

LIST OF PARTIES

Data exporter(s):Name:Customer (as defined in the Main Agreement)

Customer and any Customer Affiliates
described in the Main Agreement.
Address:
Addresses of Customer and any Customer
Affiliates described in the Main Agreement.
(or otherwise notified by Customer to 10x
Genomics

The address for Customer associated with its accountfor access to the services or as otherwise specified in
the DPA or the Main Agreement, as applicable.

Contact person’s name, position and contact
details:

The contact details associated with Customer’s accountfor access to the services or as otherwise specified in
the DPA or the Main Agreement.

Activities relevant to the data transferred under
this DPA (and SCCs, if applicable):

The provision of the services to the Customer as per theMain Agreement.

Signature and date:This Annex 1 shall be deemed executed upon executionof the DPA.

Role (controller/processor):

controller or processor

Data importer(s):Name:Address:

Contact person’s name, position and contact
details:

10x Genomics, Inc.
6230 Stoneridge Mall Road
94588-3260 Pleasanton, California
USA
Privacy@10xgenomics.com

9
10x Genomics, Inc. Data Processing Addendum[combined DPA]

Activities relevant to the data transferred under
this DPA (and SCCs, if applicable):

Processing necessary to provide the services to
Customer, pursuant to the Main Agreement.

Signature and date:This Annex 1 shall be deemed executed upon executionof the DPA.

Role (Controller/Processor):

Processor (or sub-processor)В.

DESCRIPTION OF DATA PROCESSING AND TRANSFER

1. Services Provided under the Cloud Service Terms
Categories of data subjects whose personal data isprocessed/transferred:

The data subjects can include Customer’s human clinicalsubjects and users of the services.

Categories of personal data processed/transferred:

Customer Data uploaded to the services under
Customer’s account which is pseudonymized sequence
information or other biological data.
Customer Data to which Customer allows remote accessif stored on a Customer device.
Usage data which is used in connection with theprovision of the services or a device pursuant to the
Cloud Service Terms.

Special categories of personal data (sensitive
personal data) processed/transferred (if applicable):

Customer Data uploaded to the services under
Customer’s account can include genomic sequence data.

The frequency of the processing/transfer (e.g.,whether the data is transferred on a one-off orcontinuous basis):

The personal data is transferred whenever Customer
uploads Customer Data to the services or Customer
allows remote access to a Customer device.
Usage data is transferred whenever the Customer uses theservices.

Nature of the processing/transfer:

Processing necessary to provide the services to
Customer, pursuant to the Cloud Service Terms.

Purpose(s) of the data processing/transfer andfurther processing/transfer:

Processing necessary to provide the services to
Customer, pursuant to the Cloud Service Terms.

10
10x Genomics, Inc. Data Processing Addendum[combined DPA]The period for which the personal data will be
retained, or, if that is not possible, the criteria used
to determine that period:

The duration of processing corresponds to the term of the
Cloud Service Terms.

For processing of/transfers to (sub-) processors, also
specify subject matter, nature and duration of theprocessing:Processing necessary to provide the services to
Customer, pursuant to the Cloud Service Terms and forthe duration corresponding to the term of the Cloud
Service Terms.

2. Services Provided under the Product Addendum for Xenium Catalyst Program (in the following the “Catalyst
Terms”)
Categories of data subjects whose personal data isprocessed/transferred:

The data subjects can include Customer’s humanresearch subjects and users of the services.

Categories of personal data processed/transferred:

Customer Data processed by 10x Genomics for provisionof the services pursuant to the Catalyst Terms is:••biological tissue samples and materials provided by
Customer and related information;
pseudonymized sequence information or otherbiological data resulting from the processing ofCustomer’s biological tissue samples for provisionof the services pursuant to the Catalyst Terms.

Special categories of personal data (sensitive
personal data) processed/transferred (if applicable):

Customer Data can include genomic sequence data.

The frequency of the transfer (e.g., whether the data
is processed/transferred on a one-off or continuous
basis):The personal data is transferred whenever Customer
provides biological tissue samples and materials to
10x Genomics.

Nature of the processing/transfer:

Processing of biological tissue samples and materials asnecessary to deliver to Customer pseudonymized
11

10x Genomics, Inc. Data Processing Addendum[combined DPA]

sequence information or other biological data resulting
from the processing as per the services, pursuant to theCatalyst Terms.
Purpose(s) of the data processing/transfer andfurther processing/transfer:

Processing necessary to provide the services to
Customer, pursuant to the Catalyst Terms.

The period for which the personal data will be
retained, or, if that is not possible, the criteria used
to determine that period:

Any biological tissue samples and materials provided by
Customer to 10x Genomics will be destroyed withinsixty (60) days after completion of the services pursuant
to the Catalyst Terms.
10x Genomics will delete any retained copies of the data
resulting from processing biological tissue samples andmaterials provided by Customer within 90 days after
delivery of such resulting data to Customer.

For processing of/transfers to (sub-) processors, also
specify subject matter, nature and duration of theprocessing:Processing necessary to provide the services to
Customer, pursuant to the Catalyst Terms and for thesame duration as set out above.

3. Services Provided under the Product Addendum for Xenium In Situ instruments (in the following the “Xenium
Terms”)
Categories of data subjects whose personal data isprocessed/transferred:

The data subjects include Customer’s human researchsubjects and users of the services.

Categories of personal data processed/transferred:

Customer Data processed by 10x Genomics for provisionof the services pursuant to the Xenium Terms is:••

Biological tissue samples and materials provided by
Customer and related information.
Pseudonymized sequence information or otherbiological data resulting from the processing ofCustomer’s biological tissue samples for provisionof the services pursuant to the Xenium Terms.

Usage Data processed by 10x Genomics for provision of
the services pursuant to the Xenium Terms is:

12
10x Genomics, Inc. Data Processing Addendum[combined DPA]•Special categories of personal data (sensitive
personal data) processed/transferred (if applicable):

Unique ID assigned to each user and device tomap activity at a user level.
Customer Data can include genomic sequence data or
information on non-gene sequences targeted in the
Xenium panel (which are however not identifiable for
10x Genomics).

The frequency of the processing/transfer (e.g.,whether the data is transferred on a one-off orcontinuous basis):•Nature of the processing/transfer:

•

•

•

Customer Data and Usage Data is transferred
automatically and regularly.
The other personal data is transferred wheneverCustomer provides biological tissue samples andmaterials to 10x Genomics or enables remote accessfor 10x Genomics to such data stored on its
instrument.
Usage Data is processed for the purposes of remotesupport, performance monitoring and for the
purposes of product improvement.
Processing of biological tissue samples andmaterials as necessary to deliver to Customer
pseudonymized sequence information or otherbiological data resulting from the processing as per
the services, pursuant to the Xenium Terms.

Purpose(s) of the data processing/transfer andfurther processing/transfer:

Processing necessary to provide the services to
Customer, pursuant to the Xenium Terms, including
remote support, performance monitoring and productimprovement.

The period for which the personal data will be
retained, or, if that is not possible, the criteria used
to determine that period:

Customer Data will be deleted after a period of no morethan 90 days. In case of the provision of remote support
this 90 days retention period will start after the resolutionof the support case.
Usage Data will be deleted after a period of no more than
30 days after the deletion of the Customer’s account. For
this purpose, the association between instrument usage
and Unique ID will be deleted after the deletion of the
Customer’s account.

For transfers to (sub-) processors, also specify
subject matter, nature and duration of theprocessing/transfer:

Processing necessary to provide the services to
Customer, pursuant to the Xenium Terms and for thesame duration as set out above.

13
10x Genomics, Inc. Data Processing Addendum[combined DPA]

4. Cloud Analysis services provided under the Cloud Service Terms (in the following the “Cloud Analysis
Services”)
Categories of data subjects whose personal data isprocessed/transferred:

The data subjects can include Customer’s humanresearch subjects and users of the services.

Categories of personal data processed/transferred:

•
•
•
•
•

Special categories of personal data (sensitive
personal data) processed/transferred (if applicable):

Sequence data
Customer reference transcriptomes
10x Genomics Cloud account information including
email address, first and last name of the accountholder, institution, and lab nameOutput files of the Cell Ranger pipeline that containsequencing data e.g., bam file
Telemetry data produced by Cell Ranger (including
pipeline parameters, performance metrics producedby pipelines, pseudonymized tokens)

Data uploaded by Customer can include genomic
sequence data (which is however not identifiable for
10x Genomics).

The frequency of the processing/transfer (e.g.,whether the data is transferred on a one-off orcontinuous basis):

The personal data is transferred whenever Customer
provides biological tissue samples and materials to
10x Genomics and/or uses associated Cloud Analysis
Services (e.g., Cell Ranger).

Nature of the processing/transfer:

Processing necessary to provide the Cloud Analysis
Services to Customer.

Purpose(s) of the data processing/transfer andfurther processing/transfer:

Processing necessary to provide the Cloud Analysis
Services to Customer and product development
purposes.

The period for which the personal data will be
retained, or, if that is not possible, the criteria used
to determine that period:•

14
10x Genomics, Inc. Data Processing Addendum[combined DPA]

All input and output files are stored for a minimumof 90 days unless manually deleted earlier by theuser. Certain small output files which 10x deems tobe high value are marked as “files with ongoing••For processing of/transfers to (sub-) processors, also
specify subject matter, nature and duration of theprocessing:C.

storage” and have no expiration date. These files will
persist until a user takes action to delete them.
Users have the option to opt-in to ongoing storage ata monthly fee per GB retained. This can be
discontinued at any time, and the files will be
flagged for deletion.
When any files are manually deleted or expire, they
are retained in a storage bucket for five (5) additionaldays so that 10x remains able to restore the files incase of user error. After this 5-day period, the files
are archived to a tape storage solution where they areretained for a further 180 days before being
permanently deleted.

Processing necessary to provide the services to Customer
and for the same duration as set out above.

COMPETENT SUPERVISORY AUTHORITY (if applicable)

Identify the competent supervisory authority/ies inaccordance with Clause 13 of the SCCs

The Customer’s competent supervisory authority inaccordance with the GDPR, insofar as the data transfer
is governed by the GDPR, and the FDPIC, insofar as thedata transfer is governed by the FADP.

15
10x Genomics, Inc. Data Processing Addendum[combined DPA]

Annex 2
Technical and Organizational Security Measures
10x Genomics uses AWS to host the data processed under the terms of this DPA. The applicable technical andorganizational security measures applied by AWS are described in Annex 1 to the AWS GDPR Data Processing
Addendum (https://d1.awsstatic.com/legal/aws-gdpr/AWS_GDPR_DPA.pdf).
To ensure an appropriate level of security, taking into account the nature, scope, context and purpose of theprocessing, and the risks for the rights and freedoms of natural persons, 10x Genomics has additionallyimplemented technical and organizational security measures as described for the services provided under the Cloud
Service Terms in the 10x Genomics IT security whitepaper, which is accessible here:www.10xgenomics.com/library/ab6827 and for the services provided under the Catalyst Terms in the Technical
Note On Information Security For the Xenium Catalyst Program, which is accessible here:
https://www.10xgenomics.com/resources/document-library/573c2b.

16
10x Genomics, Inc. Data Processing Addendum[combined DPA]