DATA PROCESSING SCHEDULE
This Data Processing Schedule (“DPS”) is made part of, and is hereby incorporated by reference into, the Agreement between the parties, solely with respect to the Order
Form (if any) that expressly references this DPS. To the extent that Moody’s Processes (defined below) Personal Data (defined below) on behalf of Client, the parties agree
to the following:
For purposes of this DPS:(i) “Agreement” means (a) the Master Subscription and Services Terms and Conditions; (b) the Online Terms of Agreement; (c) Terms of Agreement; or (d) Training Termsof Agreement and the Order Form(s) together thereto with this DPS and any other schedules or exhibits referenced therein;(ii) “Data Protection Legislation” means data privacy laws applicable to the processing of Personal Data under this DPS, which may include, but is not limited to, the EU
General Data Protection Regulation (2016/679) (“GDPR”);(iii) “Individual” means any natural person about whom Personal Data may be Processed under this DPS;(iv) “Personal Data” means any information that relates to an identified or identifiable natural person;(v) “Processing” or “Process” means the collection, recording, organization, structuring, alteration, use, access, disclosure, copying, transfer, storage, deletion,combination, restriction, adaptation, retrieval, consultation, destruction, disposal, or other use of Personal Data;(vi) “Products” means the Information, Products, or Services purchased pursuant to the Agreement.
(vii) “Security Incident” means any accidental or unauthorized access, acquisition, use, modification, disclosure, loss, destruction of, or damage to Personal Data, or any
other unauthorized Processing of Personal Data;
Other capitalized terms used but not defined in this DPS shall have the meaning as set forth in the Agreement.
1.

Moody’s will Process Personal Data solely in accordance with the Agreement or other documented instructions of Client (whether in written or electronic form),
or as otherwise required by applicable law to Moody’s and its provision of its Products to its customers. Moody’s acknowledges that, under the GDPR, Client is
the “data controller” or “data processor” (as applicable) and Moody’s is the “data processor”. Moody’s will hold Personal Data in confidence pursuant to theconfidentiality provisions of the Agreement and will require that Moody’s personnel granted access to Personal Data are subject to confidentiality obligations.

2.

The subject matter, nature and purpose of the Processing is to provide the Products. The duration of the Processing is until Moody’s returns or deletes thePersonal Data in accordance with this Agreement. The categories of Personal Data and affected Individuals are described in the Description of Processing forthe applicable Products at https://www.moodys.com/web/en/us/site-assets/descriptions-of-processing-data.pdf.

3.

In connection with the performance of the Agreement, Moody’s may transfer Personal Data outside the jurisdiction in which Client is established. Moody’s willprotect Personal Data in accordance with this DPS regardless of the jurisdiction in which it is located. If required by Data Protection Legislation, the parties willenter into EU Standard Contractual Clauses or maintain another method of adequacy or implement other measures sufficient to allow Moody’s to receive
Personal Data in compliance with Data Protection Legislation, including entering into any similar data transfer agreements required by Data Protection
Legislation in other countries. Moody’s will maintain a list of its processing locations and will provide this list to Client upon Client’s request or otherwise makethis list available to Client, which may include providing access to this list available at https://www.moodys.com/web/en/us/site-assets/descriptions-ofprocessing-data.pdf or on Moody’s Customer Portal; and at least thirty (30) days before adding any processing location to this list, Moody’s will provide Client
notice of such addition(s), which may include notice provided on the same page of Moody’s website that contains such list, so that Client has the opportunity
to object to such addition(s), subject to the remaining terms of this Section. Any objections made by Client pursuant to this Section must be in writing,substantiated with a reasonable and valid explanation for the objection, and submitted to the Moody’s contact identified on the aforementioned website before
the end of the stated thirty (30) day period. If Client provides such a reasonable and substantiated objection to such addition(s) in accordance with this Section,and Moody’s is unable to provide a suitable alternative, then Client may elect to exercise its termination rights without any action, claim or proceedings forliability, costs, refunds or damages against Moody’s under the Agreement. Moody’s has entered into EU Standard Contractual Clauses (Module Three:Processor to Processor), and similar data transfer agreements required by Data Protection Legislation in other countries, to facilitate intragroup transfers of
Personal Data between Moody’s Affiliates.

4.

Moody’s will implement appropriate technical and organizational safeguards designed to protect Personal Data against Security Incidents, which will include
themeasureslistedintheInformation
SecurityStandards
Schedule,availableat
https://www.moodys.com/web/en/us/siteassets/informationsecurityschedule.pdf. Moody’s may modify such safeguards from time to time, provided that such modifications will not materially reduce theoverall level of protection for Personal Data. For the purposes of the Information Security Standards Schedule as referenced herein, Personal Data shall betreated as Business Data. At Client’s request, Moody’s will provide reasonable assistance to Client in meeting its obligations under Data Protection Legislation
with respect to the security of the Processing of Personal Data through the Products, where Client cannot meet its obligations without Moody’s assistance, andtaking into account the nature of the Processing and the information available to Moody’s.

5.

Moody’s will promptly notify Client, unless prohibited by applicable laws, if Moody’s receives: (i) any requests from an Individual with respect to Moody’s
Processing of such Individual’s Personal Data, including but not limited to opt-out requests, requests for access and/or rectification, blocking, erasure, requests
for data portability, and all similar requests, and will not respond to any such requests unless expressly authorized to do so by Client; or (ii) any complaint
relating to Moody’s Processing of Personal Data, including allegations that such Processing infringes on an Individual’s rights. Client is responsible for ensuring
the accuracy of any Personal Data provided to Moody’s. At Client’s request, Moody’s will provide reasonable assistance to Client in meeting its obligations
under Data Protection Legislation with respect to requests from Individuals where Client cannot meet its obligations without Moody’s assistance. Client agrees
that Moody’s may disclose Personal Data to its subcontractors for purposes of providing Products to Client (“Sub-Processors”), provided that Moody’s will
impose on its Sub-Processors no less onerous obligations than as set forth in this DPS. Moody’s will maintain a list of its Sub-Processors and will provide thislist to Client upon Client’s request or otherwise make this list available to Client, which may include providing access to this list available athttps://www.moodys.com/web/en/us/site-assets/descriptions-of-processing-data.pdf or on Moody’s Customer Portal; and at least thirty (30) days before adding
any Sub-Processor to this list, Moody’s will provide Client notice of such addition(s), which may include notice provided on the same page of Moody’s websitethat contains such list, so that Client has the opportunity to object to such addition(s), subject to the remaining terms of this Section. Any objections made by
Client pursuant to this Section must be in writing and submitted to the Moody’s contact identified on the aforementioned website before the end of the statedthirty (30) day period. If Client objects to such addition(s) in accordance with this Section, and Moody’s is unable to provide a suitable alternative, then Client
may elect to exercise its termination rights without any action, claim or proceedings for liability, costs, refunds or damages against Moody’s under the Agreement.
Moody’s will remain responsible for all actions by Sub-Processors with respect to Client’s Personal Data and for Moody’s compliance with its obligations under
this DPS.

6.

In the event of a Security Incident, Moody’s will notify Client promptly in accordance with the time frames prescribed by applicable laws, unless otherwise
prohibited by law or otherwise instructed by a law enforcement or supervisory authority. Following such notification, Moody’s will provide reasonable assistanceand cooperation requested by Client in the furtherance of any correction or remediation of any Security Incident.
Page 1 of 3

v. October 4, 2024

7.

Upon Client’s request, Moody’s will provide reasonable assistance to Client in the event of an investigation by a competent regulator, including a data protection
regulator or similar authority, or the submission by Client of a data protection impact assessment or prior consultation document, if required by the competentregulator, solely if and to the extent that such data protection impact assessment or prior consultation document relates to Moody’s Processing of Personal
Data on behalf of Client pursuant to this DPS.

8.

Upon termination or expiration of the Agreement for any reason, Moody’s will return or destroy Personal Data at Client’s request, except as otherwise requiredby law applicable to Moody’s.

9.

Client acknowledges that Moody’s is regularly audited by independent third-party and Moody’s internal auditors.
(i)
In order to establish Moody’s compliance with this DPS, Moody’s will provide to Client, upon Client’s written request, copy third-party assessments
such as SSAE 18 SOC report or comparable report (“Third-Party Report”) where Moody’s has obtained such a Third-Party Report for the applicable Products,and written responses to all reasonable requests for information related to the applicable Products, including responses to information security and audit
questionnaires.
(ii)
Only to the extent that information provided under (i) is insufficient to reasonably establish Moody’s compliance with this DPS, or where required by
a competent regulator, Client and its authorized representatives may conduct an audit of Moody’s books and records as necessary to establish Moody’s
compliance with this DPS during the term of the Agreement. Any audit must be conducted not more than once per year, during Moody’s regular business hours,with reasonable advance notice of not less than forty-five (45) days, conducted in good faith, and subject to reasonable confidentiality procedures. Such audit
must not require Moody’s to disclose to Client or its authorized representatives any information of other Moody’s clients, internal accounting or financial
information, trade secrets, or information that, in Moody’s reasonable opinion, could compromise the security of Moody’s systems or premises or cause Moody’s
to breach its obligations under applicable Data Protection Legislation or privacy obligations to third parties. Client must promptly provide Moody’s with information
regarding any non-compliance discovered during the course of an audit.
(iii)
Any information provided to Client pursuant to this Section will be considered Moody’s Confidential Information under the confidentiality provisionsof the Agreement and will be handled accordingly.

10.

In the event of any direct conflict between the Agreement or Order Form and this DPS, this DPS shall govern.

11.

If applicable, the following California Consumer Privacy Act Addendum (“CCPA Addendum”) is made part of and hereby incorporated by reference into thisDPS.

Page 2 of 3v. October 4, 2024

CCPA Addendum
If applicable, the following terms of this CCPA Addendum govern how Moody’s will treat all personal information subject to the California Consumer Privacy Act, asamended by California Privacy Rights Act (collectively, “CCPA”) that Moody’s collects pursuant to Moody’s Agreement with Client. In the event of a conflict, this CCPA
Addendum shall govern and control with respect to personal information subject to CCPA that Moody’s collects pursuant to the Agreement. Terms used herein have thesame definitions set forth in CCPA when explicitly defined in CCPA.
1.

Moody’s shall not sell or share personal information it collects pursuant to the Agreement with Client.

2.

The Client is only disclosing the personal information to Moody’s for the limited business purpose specified in the Agreement.

3.

Moody’s shall not retain, use, or disclose the personal information that it collected pursuant to the Agreement with Client for any purposes other than thosespecified in the Agreement or as otherwise permitted by the CCPA and its regulations.

4.

Moody’s shall not retain, use, or disclose personal information it collected pursuant to the Agreement with Client for any commercial purpose other than thosespecified in the Agreement unless expressly permitted by the CCPA or its regulations.

5.

Moody’s shall not retain, use, or disclose the personal information it collected pursuant to the Agreement with Client outside the direct business relationshipbetween Moody’s and Client, unless expressly permitted by the CCPA or its regulations.

6.

Moody’s shall comply with all applicable sections of the CCPA and its regulations, including—with respect to the personal information that it collected pursuant
to the written contract with Client—providing the same level of privacy protection as required of businesses by the CCPA and its regulations.

7.

Client has the right to take reasonable and appropriate steps to ensure that Moody’s uses the personal information it collected pursuant to the Agreementwith Client in a manner consistent with Client’s obligations under the CCPA and its regulations.

8.

Moody’s shall notify Client after it makes a determination that it can no longer meet its obligations under the CCPA and its regulations.

9.

Client has the right, upon notice, to take reasonable and appropriate steps to stop and remediate Moody’s unauthorized use of personal information.

10.

Moody’s must enable the Client to comply with consumer requests made pursuant to the CCPA.

Page 3 of 3v. October 4, 2024