IVANTI DATA PROCESSING AGREEMENT

This Data Processing Agreement (“DPA”) is made as of the last signature date below (the “Effective Date”) by andbetween the applicable Ivanti entity and, to the extent required under Applicable Data Protection Laws, Ivanti’s
Authorized Affiliates (collectively “Ivanti”) and(name of Processor)
a(company type of Processor), with its principal offices located at(address of Processor) (“Processor”) (each a “Party”,
and together the “Parties”).
RECITALS
WHEREAS, the Parties have entered into a certain terms of service, letter of intent, purchase agreement, statement ofwork or other agreement between the parties (“Agreement”).
WHEREAS, in the course of providing the Services to Ivanti pursuant to the Agreement, Processor may Process
Personal Data on behalf of Ivanti;
WHEREAS, to ensure adequate safeguards with respect to the Processing of Personal Data provided by Ivanti to theProcessor the Parties agree to comply with the following provisions with respect to any Personal Data, each acting
reasonably and in good faith.
NOW, THEREFORE, in consideration of the foregoing premises and of the mutual promises and covenants set forth
below, Ivanti and Processor hereby agree as follows:
AGREEMENT1.

DEFINITIONSAll capitalized terms not defined herein shall have the meaning set forth in the Agreement.
“Affiliate” means any entity that directly or indirectly controls, is controlled by, or is under common control with thesubject entity. The term “Control,” for purposes of this definition, means direct or indirect ownership or control ofmore than 50% of the voting interests of the subject entity.
“Applicable Data Protection Laws” means all applicable laws, regulations, regulatory guidance, or requirements inany jurisdiction relating to data protection, privacy, or confidentiality of Personal Data including but not limited to (a)the EU General Data Protection Regulation (EU) 2016/679 (“GDPR”) together with any transposing, implementing
or supplemental legislation, and (b) the California Consumer Privacy Act (“CCPA”).
Authorized Affiliate” means any of Ivanti’s Affiliates which (a) are subject to the data protection laws and regulationsof the European Economic Area and/or its member states, the United Kingdom, and Switzerland, (b) are subject todata protection laws and regulations outside of the European Economic Area and/or its Member States, Switzerland,
and the United Kingdom (as applicable), and (c) permitted to use Processor for Processing pursuant to the Agreement;“CCPA” means the California Consumer Privacy Act, Cal. Civ. Code § 1798.100 et seq., and its implementing
regulations.
“Controller” or “Data Controller” means the entity which determines the purposes and means of the Processing of
Personal Data. For the avoidance of doubt, the Party identified as Ivanti above is a Controller under this DPA.
“Data Breach” means a breach of security leading to the accidental, unauthorized, or unlawful destruction, loss,
alteration, disclosure of, access to, or other Processing of Personal Data transmitted, stored, or otherwise Processed.
“Data Protection Authority” means any representative or agent of a government entity or agency who has theauthority to enforce Applicable Data Protection Laws.

Version 02.24

PRIVILEGED AND CONFIDENTIAL

IVANTI DATA PROCESSING AGREEMENT“Data Subject” means a natural person to whom Personal Data relates.
“GDPR” means the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on
the protection of natural persons with regard to the processing of personal data and on the free movement of such data,
and repealing Directive 95/46/EC (General Data Protection Regulation).
“Ivanti” means the entity identified below in the same geographic region as Customer:-

Ivanti, Inc., a Delaware corporation, in the Americas, except Brazil.
Ivanti Comércio de Software Brasil Ltda, a Brazilian company, in Brazil.
Ivanti Software K.K., a Japanese company, in Japan.
Ivanti Software Technology (Beijing) Co., Ltd., a Chinese company, in China.
Ivanti International Limited, an Irish company, for Wavelink and Naurtech branded products and services in
Europe, the Middle East, Africa, and the Asia Pacific region.
Ivanti UK Limited, a limited company registered in England and Wales, in all other locations.

“Personal Data” means any information that identifies, relates to, describes, is capable of being associated with, or
could reasonably be linked, directly or indirectly, with an identified or identifiable natural person or particularhousehold. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference
to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors
specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.
“Process” shall mean any operation or set of operations which is performed upon Personal Data by the or inconnection with and for the purposes of the provision of the Services, whether or not accomplished by automaticmeans, such as collection, recording, organization, storage, adaptation or alteration, retrieval, consultation, use,
disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasureor destruction; and as defined by Applicable Data Protection Laws.
“Processor” means the entity which Processes Personal Data on behalf of the Ivanti. For the avoidance of doubt, theParty identified as “Processor” above is a Processor for this DPA.
“Services” means Processing of Personal Data by the Processor in connection with and for the purposes of theprovision of the services to be provided by the Processor pursuant to the Parties Agreement.
“Service Provider” means a sole proprietorship, partnership, limited liability company, corporation, association, orother legal entity that is organized or operated for the profit or financial benefit of its shareholders or other owners,that process information on behalf of a Controller and to which the Controller discloses a Data Subject’s Personal
Data for a Business Purpose pursuant to a written contract, provided that the contract prohibits the Service Provider
from retaining, using, or disclosing the Personal Data for any purpose other than for the specific purpose of performing
the services specified in the contract, or as otherwise permitted by the CCPA, including retaining, using, or disclosing
the Personal Data for a Commercial Purpose other than providing the services specified in the contract with theController. The terms “Business Purpose” and “Commercial Purpose” have the same meaning as those terms areused in the CCPA. For the avoidance of doubt, Processor is a Service Provider.
“Sub-processor” means any entity which Processes Personal Data on behalf of the Processor.
2. PROCESSING OF PERSONAL DATA
2.1 Roles of the Parties. The party identified above as Ivanti is a Controller under this DPA. The party identified
above as Processor is a Processor under this DPA. The subject matter, duration, purpose of the Processing, and thetypes of Personal Data and categories of Data Subjects Processed under this DPA are further specified in Schedule 1.

Version 02.24

PRIVILEGED AND CONFIDENTIAL

IVANTI DATA PROCESSING AGREEMENT

2.2 Ivanti’s Obligations. Ivanti’s instructions for the Processing of Personal Data shall comply with Data Protection
Laws and Regulations. Ivanti shall have sole responsibility for the accuracy, quality, and legality of Personal Data andthe means by which Ivanti acquires Personal Data and provides it to Processor.
2.3 Processor’s Obligations. All Personal Data Processed by Processor pursuant to the Agreement is Confidential
Information and Processor will Process Personal Data only in accordance with Ivanti’s documented instructions set
forth in Schedule 1 or as otherwise provided by Ivanti in writing. Processor will not sell the Personal Data Processed
under this DPA and will not retain, use, or disclose Personal Data outside of the direct business relationship between
Processor and Ivanti. Processor shall adhere to all Applicable Data Protection Laws with regard to Processing Personal
Data. Where the Processor believes that compliance with any instructions by Ivanti would result in a violation of any
Applicable Data Protection Law, the Processor shall notify Ivanti thereof in writing without delay. Processor shallmake available to the Ivanti all information necessary to demonstrate Processor’s compliance with its obligations
under this DPA.
2.3.1. Assistance Requirements. Processor shall assist Ivanti with the following: compliance with Applicable Data
Protection Laws when required by Applicable Data Protection Laws; suspected and relevant Data Breaches;
notifications to, or inquiries from a Data Protection Authority; notifications to, and inquiries from, Data Subjects; andIvanti’s obligation to carry out data protection impact assessments and prior consultations with a Data Protection
Authority.
3.

NOTIFICATION OBLIGATIONS

3.1 Processor’s Notification Obligations. Processor shall immediately notify Ivanti, in writing, of the following:
3.1.1
A Data Subject’s request to exercise their privacy rights such as accessing, rectifying, erasing, transporting,objecting to, or restricting their Personal Data;
3.1.2

Any request or complaint received from Ivanti or its employees;

3.1.3

Any question, complaint, investigation, or other inquiry from a Data Protection Authority;

3.1.4
Any request for disclosure of Personal Data that is related in any way to Processor’s Processing of Personal
Data under this DPA;
3.1.5

A Data Breach pursuant to the notification obligations set forth in Section 7.1; and3.1.6
Where the Personal Data becomes subject to search a seizure, an attachment order, confiscation duringbankruptcy or insolvency proceedings, or similar events or measures by third parties while being Processed.
Processor will assist Ivanti in fulfilling Ivanti’s obligations to respond to requests relating to sections (3.1.1) - (3.1.6)
above and will not respond to such requests without Ivanti’s prior written consent unless Processor is required torespond by applicable law.
4.

CONFIDENTIALITY

4.1 Confidential Information. All Information provided to Processor pursuant to the Agreement is Confidential
Information.
4.2 Processor’s Personnel. Processor shall ensure that its personnel engaged in the Processing of Personal Data are
informed of the confidential nature of the Personal Data, have received appropriate training on their responsibilities,
and have executed written confidentiality agreements. Processor shall ensure that such confidentiality obligations
survive the termination of their respective employment relationship with such individuals.

Version 02.24

PRIVILEGED AND CONFIDENTIAL

IVANTI DATA PROCESSING AGREEMENT

4.3 Limitation of Access. Processor shall ensure that Processor’s access to Personal Data is limited to those personnel
performing Services in accordance with the Agreement.
5. SUB-PROCESSORS
5.1 Appointment of Sub-processors. Ivanti acknowledges and agrees that Processor and Processor’s Affiliates may
engage third-party Sub-processors in connection with the provision of the Services. Processor or Processor’s Affiliate
shall enter into a written agreement with each Sub-processor containing data protection obligations not less protective
than those in this DPA to the extent applicable to the nature of the Services provided by such Sub-processor. Processor
shall provide Ivanti with a list of its sub-processors and/or details of any sub-processor upon request.
5.2 Notification of Changes to Sub-processors. Processor will inform Ivanti of any intended changes concerning
the addition or replacement of Sub-processors and give Ivanti an opportunity to object to such changes. Processor
will notify Ivanti of any intended changes concerning the addition or replacement of Sub-processors in writing at least
30 days prior to its use of the Sub-processor.
5.3 Objection Right for New Sub-processors. Ivanti may object to Processor’s use of a new Sub-processor by
notifying Processor promptly in writing within fifteen (15) business days after receipt of Processor’s notice. In theevent Ivanti objects to a new Sub-processor, Processor will use reasonable efforts to make available to Ivanti a change
in the Services to avoid Processing of Personal Data by the objected-to new Sub- processor. If Processor is unable to
make available such change, Ivanti may terminate the applicable Agreement with respect to those Services whichcannot be provided by Processor without the use of the objected-to new Sub-processor.
5.4 Liability for Acts of Sub-Processors. Processor shall be liable for the acts and omissions of its Sub-processors
to the same extent Processor would be liable if performing the services of each Sub-processor directly under the termsof this DPA.
6. SECURITY
6.1 Protection of Personal Data. Processor shall maintain appropriate technical and organizational measures forprotection of the security (including protection against unauthorized or unlawful Processing and against accidental or
unlawful destruction, loss or alteration or damage, unauthorized disclosure of, or access to, Personal Data),
confidentiality and integrity of Personal Data.
6.2 Audit Rights. Ivanti agrees its right to audit Processor may be satisfied by Processor presenting up-to-dateattestations, reports or extracts from independent bodies, including without limitation external or internal auditors,
Processor’s data protection officer, the IT security department, data protection or quality auditors or other mutuallyagreed to third parties or certification by way of an IT security or data protection audit. To the extent it is not possible
to satisfy an audit obligation mandated by applicable Data Protection Laws and Regulations through such attestations,
reports or extracts, Ivanti, or Ivanti’s designee, has the right to audit and inspect—at Ivanti’s expense—Processor’s
premises, policies, procedures, and computerized systems to make sure Processor complies with the requirements inthis DPA. Ivanti, or Ivanti’s designee, will provide at least thirty (30) days notification before conducting an audit
unless such audit is required due to a Data Breach involving Processor. Audits by Ivanti or Ivanti’s designee will not
violate Processor’s confidentiality obligations with Processor’s other clients. All audits will be conducted during
normal business hours, at Processor's principal place of business or other Processor location(s) where Personal Datais accessed, processed or administered, and will not unreasonably interfere with Processor's day-to-day operations.
Before the commencement of any such audit, Processor and Ivanti shall mutually agree upon the timing, scope, andduration of the audit. Ivanti may request a summary audit report(s) or audit Processor no more than once annually.
7. DATA BREACHES

Version 02.24

PRIVILEGED AND CONFIDENTIAL

IVANTI DATA PROCESSING AGREEMENT

7.1 Data Breach Notification. Processor shall notify Ivanti in writing without undue delay after becoming aware ofa suspected Data Breach. In no event shall such notification be made more than 72 hours after Processor’s discoveryof the Data Breach.
7.2 Data Breach Management. Processor shall make reasonable efforts to identify the cause of such Data Breachand take those steps as Processor deems necessary and reasonable to remediate the cause of such a Data Breach to theextent the remediation is within Processors reasonable control.
8. TERMINATION
8.1 Termination. This DPA shall terminate automatically upon the later of (a) the termination or expiry of theAgreement or (b) Processor’s deletion or return of Personal Data. Ivanti shall further be entitled to terminate this DPA
for cause if the Processor is, in the sole opinion of Ivanti, in a material or persistent breach of this DPA which, in thecase of a breach capable of remedy, shall not have been remedied within ten (10) days from the date of receipt by theProcessor of a notice from Ivanti identifying the breach and requesting its remedy.
8.2 Return or Deletion of Data. Upon termination of this DPA, Processor will delete or return all existing copies of
Personal Data unless applicable law requires continued retention of the Personal Data. Upon the request of Ivanti, theProcessor shall confirm compliance with such obligations in writing and delete all existing copies. In instances whereapplicable law requires the Processor to retain Personal Data, Processor will protect the confidentiality, integrity, andaccessibility of the Personal Data; will not actively Process the Personal Data; and will continue to comply with theterms of this DPA.
9. MECHANISMS FOR INTERNATIONAL TRANSFERS
9.1 Transfers Outside of the EU/UK/Switzerland to a Country with an Adequacy Decision. Processor shall relyon an adequacy decision to transfer Personal Data when such adequacy decision has been granted under applicabledata protection laws. For the avoidance of doubt, if Processor is certified under the Data Privacy Framework Program,
granted by the Commission Implementing Decision of 10.7.2023 on the Adequate Level of Protection of Personal
Data Under the EU-US Data Privacy Framework (“DPF”), the DPF shall apply and supersede the applicable transfer
mechanism(s) set forth in Section 9.2 of this DPA as a valid transfer mechanism to Personal Data transferred to theUnited States.
9.2 Transfers Outside of the EU. During the provision of Services under the DPA, it may be necessary for Ivanti totransfer Personal Data from the European Union, the European Economic Area and/or their member states, the United
Kingdom, or Switzerland to Processor in a country that does not have an adequacy decision from the European
Commission or is not located in the European Economic Area. In the event of such a transfer, the Standard Contractual
Clauses apply as follows:
9.2.1. In relation to Personal Data that is subject to the GDPR (i) Processor will be deemed the "data importer" andIvanti is the "data exporter"; (ii) the Module Two terms shall apply where Ivanti is a Data Controller and where
Processor is a Data Processor; (iii) in Clause 7, the optional docking clause shall be deleted; (iv) in Clause 9 of Module
Two, Option 2 shall apply and the list of Subprocessors and time period for notice of changes shall be as agreed under
Section 5 of this DPA; (v) in Clause 11, the optional language shall be deleted; (vi) in Clause 17, Option 1 shall apply
and the Standard Contractual Clauses shall be governed by the member state where Ivanti is domiciled; (vii) in Clause18(b), disputes shall be resolved before the courts of the member state where Ivanti is domiciled; (viii) Annex I and
Annex II shall be deemed completed with the information set out in Schedule 1 of this DPA respectively; and (ix) if
and to the extent the Standard Contractual Clauses conflict with any provision of the Agreement (including this DPA)
the Standard Contractual Clauses shall prevail to the extent of such conflict. For this section, the Standard Contractual
Clauses from the Commission Implementing Decision (EU) 2021/914 are incorporated by reference and available
here:
https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standardcontractual-clauses-scc/standard-contractual-clauses-international-transfers_en.

Version 02.24

PRIVILEGED AND CONFIDENTIAL

IVANTI DATA PROCESSING AGREEMENT

9.2.2. In relation to Personal Data that is subject to the GDPR where Processor is acting as a Sub-processor to Ivantiand Ivanti is acting as a Processor, (i) Ivanti is the "data exporter" and the Sub-processor will be deemed the "dataimporter" and; (ii) the Module Three terms shall apply; (iii) in Clause 7, the optional docking clause shall be deleted;(iv) in Clause 9, Option 2 shall apply and the list of Sub-processors and time period for notice of changes shall be as
agreed under Section 5 of this DPA; (v) in Clause 11, the optional language shall be deleted; (vi) in Clause 17, Option
1 shall apply and the Standard Contractual Clauses shall be governed by the member state where Channel Partner isdomiciled; (vii) in Clause 18(b), disputes shall be resolved before the courts of the member state where Channel
Partner is domiciled; (viii) Annex I and Annex II shall be deemed completed with the information set out in Schedule
1 of this DPA respectively; and (ix) if and to the extent the Standard Contractual Clauses conflict with any provisionof the Agreement (including this DPA) the Standard Contractual Clauses shall prevail to the extent of such conflict.
For this section, the Standard Contractual Clauses from the Commission Implementing Decision (EU) 2021/914 areincorporated by reference and available here: https://ec.europa.eu/info/law/law-topic/data-protection/internationaldimension-data-protection/standard-contractual-clauses-scc/standard-contractual-clauses-international-transfers_en.
9.2.3. In relation to Personal Data that is subject to UK Data Protection Laws, the International Data Transfer
Agreement (“IDTA”) shall apply with the following modifications: (i) the contact information about the parties to theAgreement is the contact information for the IDTA; (ii) Ivanti is the data exporter and Processor is the data importer;(iii) the laws that govern the IDTA and the location where legal claims can be made is England and Wales; (iv) the
UK GDPR does not apply to the data importer’s processing of transferred data; (v) the Parties do not use the additional
security or commercial clauses from the IDTA; and (vi) the information in this DPA and Schedule 1 can be used forTables 1-4. For this section, the Standard Contractual Clauses from the Information Commissioner’s Office areincorporated by reference and available here: https://ico.org.uk/for-organisations/guide-to-data-protection/guide-tothe-general-data-protection-regulation-gdpr/international-data-transfer-agreement-and-guidance/.
9.2.4. In relation to Personal Data that is subject to the Swiss DPA, the Standard Contractual Clauses referenced in
Section 9.1.1 shall apply with the following modifications (i) references to "Regulation (EU) 2016/679" shall beinterpreted as references to the Swiss DPA; (ii) references to "EU", "Union" and "Member State law" shall beinterpreted as references to Swiss law; and (iii) references to the "competent supervisory authority" and "competentcourts" shall be replaced with the "the Swiss Federal Data Protection and Information Commissioner " and the"relevant courts in Switzerland".
9.3. Alternative Data Transfer Mechanisms. The Parties acknowledge that the laws, rules and regulations relating
to international data transfers are rapidly evolving. In the event that Ivanti adopts another mechanism authorized byapplicable laws, rules or regulations to transfer Personal Data (each an “Alternative Data Transfer Mechanism”), theParties agree to work together in good faith to implement any amendments to this Agreement necessary to implement
the Alternative Data Transfer Mechanism.
If a law or regulation replaces or supersedes any of the standard contractual clauses referenced in this Section, theparties may adopt the text of the new standard contractual clauses without having to amend this DPA.
10. MISCELLANEOUS PROVISIONS
10.1. Amendments. This DPA may not be amended or supplemented, nor shall any of its provisions be deemed to be
waived or otherwise modified, except through a writing duly executed by authorized representatives of both Parties.
10.2 Governing Law. This DPA shall be governed by the governing law set forth in the Agreement.
IN WITNESS WHEREOF, the parties hereto have executed this Agreement as of the Effective Date.

Version 02.24

PRIVILEGED AND CONFIDENTIAL

IVANTI DATA PROCESSING AGREEMENTIVANTIPROCESSOR:

By:

By:

Name:

Name:

Title:

Title:

Date:

Date:

List of Schedules:
Schedule 1: Description of Processing

Version 02.24

PRIVILEGED AND CONFIDENTIAL

IVANTI DATA PROCESSING AGREEMENTSCHEDULE 1
Description of Processing
Contact Information
Party Name: IvantiAddress: As stated in the Agreement.
Representative/DPO/Privacy Office Email: privacy@ivanti.com
Party Name: Processor
Address: As stated in the Agreement.
Representative/DPO/Privacy Office Email:Subject-Matter
The subject-matter of the Processing:Processing of Personal Data pursuant to the provision of services by Processor, as more particularly described in theAgreement.
Duration
Duration of the Processing:As set forth in the Agreement between the Parties.
Extent, Type and Purpose of the Processing
The extent, type and purpose of the Processing is as follows:
As set forth in the Agreement between the Parties.
Frequency of Transfer
Continuous
Categories of Data Subjects
Personal Data Processing may relate to the following categories of Data Subjects:
Ivanti employees, Ivanti customers, Ivanti partners, Ivanti end-users, contractors, and prospective customers andsponsors (and, in relation to each of the foregoing, employees thereof).
Categories of Data
The Personal Data Processed may concern the following categories of data as approved by the Controller:- Identification data and employee master data (which may include title, name, address, telephone number,
fax number, company address, email address);- Authentication data;- Contact information;- Internet protocol (IP) address and other computer identifiers;- User-provided content;- Pseudonymous identifiers;- Photos, videos, and audio;- Device identifiers; and- Other data, as described in the Agreement.
Technical Measures to Secure Data
Processor acknowledges that it will implement and maintain the applicable Supplier Security Requirements
available at https://www.ivanti.com/company/legal.

Version 02.24

PRIVILEGED AND CONFIDENTIAL