GLOBAL DATA PROCESSING ADDENDUM (“DPA”) - VERINT AS CUSTOMER’S DATA PROCESSOR/SERVICE PROVIDERThis DPA forms part of the applicable agreement for the procurement of Verint offerings (“Agreement”) by and between the applicable Verint entity and your company (“Customer”).

1.
1.1
1.1.1

1.1.2

1.1.3

1.1.4

1.1.5
1.1.6
1.1.7
1.1.8
1.1.9

1.1.101.1.11
1.1.12
1.1.13
1.1.141.1.151.1.161.1.17

Definitions
In this DPA, the following terms shall have the meanings set out below and cognate
terms shall be construed accordingly:“Adequacy Decision” means, for a jurisdiction with Privacy Laws that impose
restrictions on certain cross border transfers of Personal Data for subsequent
processing, a decision of a Supervisory Authority, legislative or executive body insuch jurisdiction which recognises that the destination jurisdiction in respect of across border transfer either by application of its own Privacy Laws or by other legal
measures, provides an adequate level of protection in respect of the Processing of
Personal Data in that destination jurisdiction;“Affiliate” means any entity which now or in the future controls, is controlled by, oris under common control with the signatory to this DPA, with "control" defined as thepossession, directly or indirectly, of the power to direct or cause the direction of the
management and policies of such person or entity, whether through the ownershipof voting securities, by contract, or otherwise;“Data Controller” means the natural or legal person, public authority, agency orother body which, alone or jointly with others, determines the purposes and meansof the Processing of Personal Data, and in the context of this DPA shall mean
Customer;"Data Privacy Framework" means the EU-U.S. Data Privacy Framework, theSwiss-U.S. Data Privacy Framework and the UK Extension to the EU-U.S. Data
Privacy Framework self-certification programs (as applicable) operated by the U.S.
Department of Commerce; as may be amended, superseded or replaced.
"Data Privacy Framework Principles" means the Principles and Supplemental
Principles contained in the relevant Data Privacy Framework; as may be amended,superseded or replaced.
“Data Processing Instructions” means the Processing instructions set out athttps://www.verint.com/our-company/legal-documents/dpa/data-processingschedule/;“Data Processor” or “Service Provider” means a natural or legal person, publicauthority, agency or other body which Processes Personal Data on behalf of theData Controller, and in the context of this DPA shall mean Verint;“Data Subject” means an identified or identifiable natural or legal person;“Information Security Schedule” means the information security, technical andorganisational measures specified in the Information Security Schedule, as may be
updated from time to time, set out at https://www.verint.com/wpcontent/uploads/Verint-Information-Security-Schedule.pdf;“Personal Data” shall have the meaning set out in, and will be interpreted inaccordance with Privacy Laws, and in the context of this DPA, shall mean the
personal data related to a Data Subject used for Processing which is provided by
Customer to Verint or directly or indirectly received or obtained by Verint inconnection with the provision of the Services at the request of Customer;“Personal Data Breach” means a breach of security leading to the accidental or
unlawful destruction, loss, alteration, unauthorised disclosure of, or access to,
Personal Data transmitted, stored or otherwise Processed;"Permitted Transfer” as defined in Section 11.
“Privacy Laws” means national, federal, union, state and other laws, as applicableto the Processing of Personal Data;“Process”, “Processing” or “Processed” means any operation or set of operations
that is performed upon Personal Data in connection with the Services, whether or
not by automatic means, such as access, collection, recording, organization,
storage, adaptation or alteration, retrieval, consultation, use, disclosure bytransmission, dissemination or otherwise making available, alignment or
combination, blocking, return or destruction, as described in the Agreement andData Processing Instructions;"Restricted Transfer" means:
1.1.15.1 a transfer of Personal Data from Customer to Verint for Processing; or1.1.15.2 an onward transfer of Personal Data from Verint to a Subprocessor for
Processing,in each case, where such transfer outside of the jurisdiction where the Personal
Data originates would be prohibited by relevant and applicable Privacy Laws in theabsence of an approved method of lawful transfer, including through (a) an
Adequacy Decision (which includes the Data Privacy Framework), (b) Standard
Contractual Clauses, or (c) by the terms of other recognised forms of data transfer
agreements or other lawful processes approved by a Supervisory Authority;"Services" means the services and other activities to be supplied to or carried out
by or on behalf of Verint for Customer pursuant to the Agreement;"Standard Contractual Clauses" means the contractual clauses approved by adecision of Supervisory Authority, legislative or executive body pursuant to Privacy
Laws which provides for transfer of Personal Data from the jurisdiction from which
the Personal Data originates to another jurisdiction where such transfer would(REV 12JAN2024)

1.1.181.1.19
1.1.20

1.2
1.3
1.4
1.5

2.
2.1

2.2
2.3
2.3.1
2.3.2
2.3.3
2.4
2.4.1
2.4.2
2.5

3.
3.1
3.2

otherwise be a Restricted Transfer, including those set out in the Appendices to this
DPA;
"Subprocessor" means any third party (including any third party and any Verint
Affiliate) appointed by or on behalf of Verint to undertake Processing in connection
with the Services;“Supervisory Authority” means an independent competent public authority orother legal body which is established in a jurisdiction under Privacy Laws andresponsible for monitoring or enforcement applicable Privacy Laws; and“Supplementary Measures” means those measures that are considerednecessary under certain Privacy Laws to apply additional protections to Personal
Data transferred under a Permitted Transfer as such measures are set out athttps://www.verint.com/our-company/legal-documents/dpa/supplementarymeasures/;
The word "include" shall be construed to mean include without limitation, andcognate terms shall be construed accordingly.
References in this DPA to Verint include to Verint Affiliates where such Verint
Affiliates are Subprocessors.
References to Customer shall mean Customer Affiliates where such Affiliates are
Data Controllers.
The terms used in this DPA shall have the meanings set forth in this DPA provided
that capitalized terms not otherwise defined herein shall have the meaning given tothem in the Agreement. Except as modified below, the terms of the Agreement shallremain unchanged and in full force and effect.
Appointment of Verint
Customer appoints Verint as its Data Processor (Service Provider) and agrees that
all Personal Data provided to Verint pursuant to the Agreement and this DPA
complies with the collection, transmission and lawful processing requirements underrelevant Privacy Laws to enable the Processing.
Verint agrees to treat Personal Data as Customer Confidential Information.
Verint will not:Process Personal Data other than as set out in this DPA and in the Agreement
unless upon Customer’s further written instructions or as required by a Supervisory
Authority;sell Personal Data; orshare, use or disclose the Personal Data unless it is authorized in accordance with
the Agreement, this DPA, any Order, upon Customer’s further written instructions or
as required by a Supervisory Authority.
Customer on behalf of itself and each Customer Affiliate which is the Data Controllerof the Personal Data instructs Verint:
To Process Personal Data; andSubject to Section 11, transfer Personal Data to any country or territory; in eachcase as reasonably necessary for the provision of the Services and consistent withthis DPA.
The Data Processing Instructions sets out the subject matter and other details
regarding the Processing of the Personal Data contemplated as part of the Services,
including Data Subjects, categories of Personal Data, special categories of Personal
Data, Subprocessors and description of Processing.
Verint Personnel
Verint shall ensure that persons authorised to undertake Processing of the Personal
Data have:committed themselves to confidentiality or are under an appropriate statutory
obligation of confidentiality in respect of the Personal Data; andundertaken appropriate training in relation to protection and security of Personal
Data.

4.
4.1

Security
Taking into account the state of the art, the costs of implementation and the nature,
scope, context and purposes of Processing as well as the risk of varying likelihoodand severity for the rights and freedoms of Data Subjects, including the risk of a
Personal Data Breach. Verint shall implement appropriate technical andorganisational measures designed to provide a level of security appropriate to therisk in Processing and for the purposes of this DPA Verint’s technical andorganisational measures are set out in the Information Security Schedule.

5.
5.1

Subprocessing
Verint shall only appoint Subprocessors which enable Verint to comply with this
DPA. Customer authorises Verint to appoint Subprocessors in accordance with thisSection 5 subject to any restrictions or conditions expressly set out in the Agreement
or applicable Order. Subprocessors appointed as at the effective date of this DPA
are listed in the Data Processing Instructions and/or as specified in an Order. Verint
shall remain liable to Customer for the performance of that Subprocessor’s
obligations.

Copyright © Verint Systems Inc., all rights reserved.

1

5.2

5.3
5.3.1
5.3.2
5.3.3

6.
6.1
6.1.1

6.1.2
6.2

7.
7.1

7.1.1
7.1.2
7.1.3
7.2
7.3

8.
8.1

Notwithstanding any notice requirements in the Agreement, before Verint engages
any new Subprocessor not authorized in accordance with Section 5.1, Verint shallgive Customer notice of such appointment, including details of the Processing to beundertaken by the proposed Subprocessor and for this purpose, Verint may provide
such notice by updating the list of Subprocessors in the Data Processing
Instructions. Customer may notify Verint of any objections (on reasonable grounds
related to Privacy Laws) to the proposed Subprocessor or Data Processing
Instructions (“Objection”). Upon receipt of the Objection, Verint and Customer shallnegotiate in good faith to agree to further measures including contractual or
operational adjustments relevant to the appointment of the proposed Subprocessor
or operation of the Services to address the Objection. Where such further measures
cannot be agreed between the parties within forty-five (45) days from Verint’s receiptof the Objection (or such greater period agreed by Customer in writing), Customer
may by written notice to Verint with immediate effect terminate that part of theServices which require the use of the proposed Subprocessor.
With respect to each Subprocessor which is the subject of Section 5.2 above, Verint
or the relevant Verint Affiliate shall:carry out adequate due diligence before the Subprocessor first Processes Personal
Data to ensure that the Subprocessor is capable of providing the level of protection
for Personal Data required by the Agreement;
ensure that the Subprocessor is subject to a written agreement with Verint that
includes appropriate data protection provisions; andif that arrangement involves a Restricted Transfer, ensure that the Standard
Contractual Clauses or other appropriate method of transfer are at all relevant times
incorporated into the agreement executed between Verint and the Subprocessor.
Complying With Individual Rights of Data Subjects
Verint shall:
upon becoming aware, promptly notify Customer if Verint receives a request from a
Data Subject (or persons appointed to act on their behalf) relating to an actionable
right of the Data Subject under any Privacy Law in respect of Personal Data in
Verint’s possession for Processing (each being an “Individual Rights Request”);
andnot respond to any Individual Rights Request except on the written instructions of
Customer, (which Customer shall promptly provide to Verint if it requires Verint to
respond), or otherwise as required by a Supervisory Authority.
Customer may where required by Privacy Laws and where directly relevant to theServices, request Verint in writing to reasonably assist Customer in dealing with a
Data Subject rights request validly made under Privacy Law directly to the Customer
or connected with an Individual Rights Request to the extent Customer cannot fulfil
this request without Verint’s assistance. Verint may fulfil this request by making
available functionality that enables Customer to address such Data Subject rights
request without additional Processing by Verint. If Customer declines to use suchfunctionality or to the extent such functionality is not available, Verint may provide
such assistance in accordance with a mutually agreed Order.
Personal Data BreachVerint shall notify Customer without undue delay upon Verint or any Subprocessor
becoming aware of a Personal Data Breach, providing Customer with sufficient
information to allow Customer to meet its obligations under Privacy Law to report toor inform Data Subjects and/or a Supervisory Authority of the Personal Data Breach.
Subject to Section 7.3 below, such notification shall as a minimum:
describe the nature of the Personal Data Breach, the categories and numbers ofData Subjects concerned, and the categories and numbers of Personal Data
records concerned;
communicate the name and contact details of Verint's data protection officer or otherrelevant contact from whom more information about the Personal Data Breach may
be obtained; anddescribe the measures taken or proposed to be taken to address the Personal Data
Breach.
Verint shall co-operate with Customer and take such reasonable commercial steps
as are necessary to assist in the investigation, mitigation and remediation of any
Personal Data Breach.
Where and in so far as, it is not possible to provide the information referred to in
Section 7.1 at the same time as notification of the Personal Data Breach, theinformation may be provided in phases without undue further delay. Verint’s
obligation to report or respond to a Personal Data Breach under this Section 7 is not
and will not be construed as an acknowledgement by Verint of any fault or liabilityof Verint (or its Affiliates) with respect to a Personal Data Breach.
Data Protection Impact Assessment and Prior Consultation
Where directly connected to Processing, Verint shall provide reasonable assistanceto Customer with any data protection impact assessments (or similar assessments,
and prior consultations with Supervising Authorities or other competent data privacy
authorities), which Customer reasonably considers to be required by Privacy Laws.
To the extent that such impact assessment and/or prior consultation requires
assistance beyond Verint providing the applicable Verint maintained records of(REV 12JAN2024)

Processing, security of Personal Data and/or associated Documentation, Verint may
provide such assistance in accordance with a mutually agreed Order.
9.
9.1

9.2

10.
10.1
10.2

10.3

10.4

Deletion or return of Personal Data
Unless otherwise provided for in the Agreement, Verint will within thirty (30) days
from termination or expiry of the Agreement (the “Return Period”), and subject toSection 9.2 below, at Customer’s request, delete or return available Personal Data.
At the expiry of the Return Period, if Customer has not elected either of the foregoing
Verint may delete and destroy all Personal Data without liability to Customer. Where
Customer requests Verint to return available Personal Data, Verint may fulfil thisrequest by making available functionality that enables Customer to retrieve the
Personal Data without additional Processing by Verint. If Customer declines to use
this functionality, Customer may, within the Return Period, request that Verint return
the available Personal Data under an Order for the applicable professional services.
In the event the Agreement is terminated for Customer’s breach, Verint shall havethe right to require that Customer prepay for such professional services. Verint shallprovide written confirmation to Customer that it has fully complied with this Section
9 within thirty (30) days of Customer’s request for such confirmation.
Verint may retain Personal Data to the extent required by Privacy Laws or any otherstatutory requirement to which Verint is subject and only to the extent and for such
period as required by Privacy Laws or any other statutory requirement provided
always that (a) during such retention period the provisions of this DPA will continue
to apply, (b) Verint shall ensure that such Personal Data is only Processed asnecessary for the purpose(s) specified in the Privacy Laws or any other statutory
requirement applicable to Verint requiring its storage or any other statutory
requirement to which Verint is subject and for no other purpose.
Review, Audit and Inspection rights
Upon Customer’s reasonable request, Verint shall provide all relevant andnecessary material, documentation and evidence that it complies with Section 4 ofthis DPA.
If, following the completion of the steps set out in Section 10.1 Customer reasonably
believes that Verint is non-compliant with Privacy Laws, Customer shall provide
sufficient written details thereof and allow Verint a reasonable opportunity torespond after which Customer may request that Verint make available, either bywebinar or in a face-to-face review with appropriate Verint Personnel, extracts of all
relevant information necessary to further demonstrate Verint’s compliance with
Privacy Laws and this DPA. Customer shall provide reasonable notice of a review
to be conducted under this Section 10.2, by contacting Verint’s Global Privacy
Officer using Verint’s Privacy Portal.
In the event that Customer reasonably believes that its findings following the steps
set out in Section 10.2 do not enable Customer to comply materially with Customer’s
obligations mandated under the Privacy Laws in relation to its appointment of Verint
as Data Processor, then Customer may give Verint not less than thirty (30) days
prior written notice by contacting Verint’s Global Privacy Officer using Verint’s
Privacy Portal of its intention to undertake an audit which may include inspectionsof Verint to be conducted by Customer or a third party auditor mandated by
Customer (such third party not being a competitor of Verint). Such audit and/or
inspection shall (i) be subject to confidentiality obligations agreed between
Customer (or its mandated third party auditor) and Verint, (ii) be undertaken solely
to the extent mandated by, and may not be further restricted under applicable
Privacy Laws, (iii) not require Verint to compromise the confidentiality of security
aspects of its systems and/or data processing facilities (including that of its
Subprocessors), and (iv) not be undertaken in such manner so as to place Verint inbreach of Verint’s confidentiality obligations to other Verint customers vendors
and/or partners or otherwise cause Verint to breach laws applicable to Verint.
Customer (or third party auditor mandated by Customer) undertaking such audit orinspection shall avoid causing any damage, injury or disruption to Verint’s premises,
equipment, systems and/or personnel and shall minimize the impact of such audit
or inspection to the extent reasonably possible. To the extent that such audit
performed in accordance with this Section 10.3 exceeds one (1) business day,Verint shall reserve the right to charge Customer for each additional day at its thencurrent daily rates.
If Customer has reasonable grounds following an audit or inspection undertaken
pursuant to Section 10.3 to determine that Verint is non-compliant with Privacy
Laws or this DPA, then Customer will provide details thereof to Verint upon receiptof which Verint shall provide its written response and to the extent required, a draft
remediation plan for the mutual agreement of the parties (such agreement not to be
unreasonably withheld or delayed) where the mutually agreed plan shall be termed
the “Remediation Plan”. Where the parties are unable to reach agreement on the
Remediation Plan, or in the event of agreement, Verint materially fails to implement
the Remediation Plan by the agreed dates which in either case is not cured within
forty-five (45) days following Customer’s notice or another period as mutually agreed
between the Parties, Customer may terminate the Order for Services in part or inwhole falling under the Remediation Plan provided that any other Services not
subject to the Remediation Plan shall continue unaffected by such termination.

Copyright © Verint Systems Inc., all rights reserved.

2

10.5

The rights of Customer under this Section 10 shall only be exercised once percalendar year unless Customer reasonably believes Verint to be in material breachof its obligations under either this DPA or Privacy Laws.

11.
11.1

Restricted Transfers
Whenever a Restricted Transfer occurs, each party will ensure that such transfer ismade in compliance with the relevant provisions of Privacy Law.
Certain of Verint’s Affiliates have certified compliance with the Data Privacy
Framework as set out in Verint’s privacy notice. To the extent that a RestrictedTransfer involves transferring Personal Data to the United States, and provided
always that the transfer falls under the scope of Verint’s self-certification to the Data
Privacy Framework, then:
11.2.1
Verint will rely on the Data Privacy Framework to establish that the
Restricted Transfer is compliant with the relevant provisions of Privacy
Law, unless the Data Privacy Framework shall become invalid, beamended or withdrawn or otherwise Verint no longer maintains
certification under the Data Privacy Framework, in which case theprovisions of Section 11.3 shall apply; and11.2.2
Verint will ensure that it provides at least the same level of protection tosuch Personal Data as is required by the Data Privacy Framework
Principles and will inform Customer if it is unable to comply with thisrequirement.
Subject to the provisions of Section 11.2, the Standard Contractual Clauses are
hereby incorporated into this DPA and shall apply to any Restricted Transfer.
Where there is any conflict between the terms of this DPA and either the Data
Privacy Framework or the Standard Contractual Clauses (as the case may be) theneither the Data Privacy Framework or the Standard Contractual Clauses shallprevail.
Upon request, Verint shall where required by Privacy Law, provide Customer withevidence that it has undertaken an appropriate transfer risk assessment in relation
to the relevant Restricted Transfer or otherwise shall undertake such transfer risk
assessment.
A Restricted Transfer which subsequently satisfies the relevant Privacy Law
following an Adequacy Decision, adoption of Standard Contractual Clauses oranother transfer tool permitted under applicable Privacy Law shall be termed a“Permitted Transfer” under this DPA

11.2

11.3
11.4

11.5

11.6

12.
12.1

12.2

13.
13.1
13.2

Other Privacy Laws
To the extent that Processing relates to Personal Data originating from a jurisdiction
or in a jurisdiction which has any mandatory requirements in addition to those in this
DPA, including Standard Contractual Clauses, the parties may agree to any
additional measures required to ensure compliance with applicable Privacy Laws as
an Appendix to this DPA or in a duly executed written addendum or amendment tothis DPA or in an Order.
If any variation is required to this DPA as a result of a change in Privacy Laws theneither party may provide written notice to the other party of that change in law. The
parties will discuss and negotiate in good faith any necessary variations to this DPA,
including incorporation of the Standard Contractual Clauses, to address suchchanges.
Supplementary Measures/Additional Safeguards
Verint shall comply with the Supplementary Measures.
Verint has no reason to believe that the laws and practices in a destination country
which is the transfer destination of Personal Data for further Processing following a
Permitted Transfer (“the Destination Country”), including any requirements todisclose Personal Data or measures authorising access by public authorities,
prevents Verint from fulfilling its obligations under this DPA.

(REV 12JAN2024)

13.3

13.4

13.5
13.5.1

13.5.213.5.3

14.
14.1

14.2
14.3
14.4
14.5

14.6

Verint agrees to promptly notify Customer if at any time it makes a determinationthat it can no longer comply with its performance obligations under this DPA or
Privacy Laws as they apply to Verint or if it has reason to believe that it is or has
become subject to laws or practices not in line with the requirements under Section
13.2, including following a change in the laws of the Destination Country or ameasure (such as a disclosure request) indicating an application of such laws inpractice that is not in line with the requirements in Section 13.2.
Following a notification pursuant to Section 13.3, Verint shall promptly identify
appropriate measures (e.g. technical or organisational measures to ensure security
and confidentiality) to address the situation. Any Permitted Transfer shall besuspended if Verint or Customer (on notice to Verint) reasonably considers that no
appropriate safeguards for such transfer can be ensured, or if instructed by aSupervisory Authority to do so. If the suspension cannot be lifted within a reasonable
period, Customer shall be entitled to terminate the affected Order (or affectedcomponent of an Order) in accordance with Section 13 of Schedule B provided thatany remaining Services shall otherwise continue unaffected by such termination.
Verint shall, unless legally prohibited from doing so:
promptly notify the Customer in the event if it receives a legally binding request froma public authority, including judicial authorities, under the laws of a Destination
Country for the disclosure of Personal Data including information about the personal
data requested, the requesting authority, the legal basis for the request and the
response provided; orpromptly notify the Customer in the event it becomes aware of any direct access by
public authorities exercising a right under the laws of the Destination Country in
relation to the Personal Data transferred to the Destination Country for Processing;andin respect of such a request or direct access as aforesaid take such steps as arenecessary to keep disclosure and access to the minimum and provide Customer
with as much information as legally permissible.
General Terms
Except for the governing law and jurisdiction provisions of the Standard Contractual
Clauses, the parties to this DPA hereby submit to the applicable choice of governing
law and jurisdiction stipulated in the Agreement with respect to any disputes orclaims howsoever arising under this DPA, including disputes regarding its existence,
validity or termination or the consequences of its nullity.
The UN Convention on Contracts for the International Sale of Goods shall not apply
in any respect to this DPA or the Agreement (and any associated Orders) or theparties, regardless of the applicable governing law and jurisdiction.
The parties agree that any electronic link included in this DPA and the content
thereof form integral part of this DPA.
In the event of inconsistencies between the provisions of this DPA and any part ofany other agreements between the parties, including the Agreement, the provisionsof this DPA shall prevail.
Should any provision of this DPA be invalid or unenforceable, then the remainder ofthis DPA shall remain valid and in force. The invalid or unenforceable provision shallbe either (i) amended as necessary in writing by the parties to ensure its validity andenforceability, while preserving the parties’ intentions as closely as possible or, if
this is not possible, (ii) construed in a manner as if the invalid or unenforceable part
had never been contained therein.
This DPA constitutes the entire agreement and understanding of the parties relating
to Processing, superseding all prior or contemporaneous agreements,
representations, promises and understandings, whether written, electronic, oral orotherwise.

Copyright © Verint Systems Inc., all rights reserved.

3

APPENDIX 1
EUROPEAN, SWISS AND UNITED KINGDOM TERRITORY SPECIFIC TERMS
1.

The Standard Contractual Clauses for the purposes of this Appendix shall mean the EU Standard Contractual Clauses where the “EU Standard Contractual Clauses” shall mean
the standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679, as set out in the European Commission’s Implementing
Decision 2021/914 of 4 June 2021, as may be amended, replaced or superseded by the European Commission from time to time as the modules Annexes and adapted by thisAppendix 1. To the extent of any conflict between the body of this DPA and this Appendix 1, this Appendix 1 shall prevail of any conflicting term in the body of this DPA. Notwithstanding
the foregoing, as required by clause 5 of the EU Standard Contractual Clauses, the EU Standard Contractual Clauses shall prevail over any other term of this DPA and the Agreement.

2.

In respect of any Restricted Transfers from the European Economic Area, the parties agree to the following:

3.

4.

2.1.

The EU Standard Contractual Clauses will be incorporated into this DPA;

2.2.

The modules and Annexes of the EU Standard Contractual Clauses are set out at https://www.verint.com/wp-content/uploads/Modules-to-SCC-pursuant-to-Regulation-EU2016-679.pdf; and2.3.

The parties agree that execution of this DPA or the agreement into which it is incorporated constitutes signature and acceptance of Annex 1.A to this Schedule 1 of this DPA
and acceptance and incorporation of the EU Standard Contractual Clauses.

In respect of any Restricted Transfers from the United Kingdom, the parties agree to the following:
3.1.

The Standard Contractual Clauses shall mean the UK Addendum where “UK Addendum” means the International Data Transfer Addendum to EU Transfer Contract Clauses
in force 21st March 2022, as may be amended, replaced or superseded by the ICO from time to time (including when formally issued by the ICO under section 119A(1) of the
UK Data Protection Act 2018);

3.2.

The UK Addendum will be incorporated into this DPA;

3.3.

The parties agree that execution of this DPA or the agreement into which it is incorporated constitutes signature and acceptance of Annex 1.A to this Schedule 1 of this DPA
and acceptance and incorporation of Annex 1A to this Schedule and acceptance and incorporation of the UK Addendum; and3.4.

Tables 1 to 4 (inclusive) to the UK Addendum shall be deemed completed with the information set out in at https://www.verint.com/wp-content/uploads/Modules-to-SCCpursuant-to-Regulation-EU-2016-679.pdf;

In respect of any Restricted Transfers from Switzerland, the parties agree to the following:
4.1.

The EU Standard Contractual Clauses shall have the same meaning as described in paragraph 1 and as approved by the Swiss Data Protection and Information Commissioner,
including the necessary adaptations to ensure compliance with Swiss data protection law as set out at https://www.verint.com/wp-content/uploads/Modules-to-SCC-pursuantto-Regulation-EU-2016-679.pdf;

4.2.

The EU Standard Contractual Clauses will be incorporated into this DPA;

4.3.

The parties agree that execution of this DPA or the agreement into which it is incorporated constitutes incorporated constitutes signature and acceptance of Annex 1.A to thisSchedule 1 of this DPA and acceptance and incorporation of the EU Standard Contractual Clauses.

ANNEX 1.ACOMMISSION IMPLEMENTING DECISION (EU) 2021/914
OF 4 JUNE 2021
ON STANDARD CONTRACTUAL CLAUSES FOR THE TRANSFER OF PERSONAL DATA TO THIRD COUNTRIES PURSUANT TO REGULATION (EU) 2016/679 OF THE
EUROPEAN PARLIAMENT AND OF THE COUNCIL(…)
APPENDIXANNEX I
A. LIST OF PARTIES
Data exporter(s):Name: … the contracting party specified as Customer in this DPA or the relevant Customer Affiliate acting as Data exporter1.

Address: … The address specified for the Customer in the Agreement
Contact person’s name, position and contact details: … The primary contact details which Verint holds on file for the Customer
Activities relevant to the data transferred under these Clauses: …as specified in the Data Processing Instructions
Signature and date: … as evidenced by signature of the DPA or the Agreement into which the DPA is incorporated
Role (controller/processor): …controller…

2.

(REV 12JAN2024)

Copyright © Verint Systems Inc., all rights reserved.

4

Data importer(s):Name: …The contracting party specified as Verint in this DPA
1.

Address: …The Verint address specified in the Agreement
Contact person’s name, position and contact details: …Verint’s Global Privacy Officer contacted by submitting a request via Verint’s Privacy Portal
Activities relevant to the data transferred under these Clauses: …as specified in the Agreement and the Data Processing Instructions
Signature and date: … as evidenced by signature of the DPA or the Agreement into which the DPA is incorporated
Role (controller/processor): … processor…

2.
IN WITNESS WHEREOF, this DPA is entered into and becomes a binding part of the Agreement with effect from the last date of signature.
VERINTCUSTOMERNAME SIGNEDNAME SIGNED

NAME

NAME

TITLE PRINTEDTITLE PRINTED

DATE

DATE

(REV 12JAN2024)

Copyright © Verint Systems Inc., all rights reserved.

5

APPENDIX 2
CALIFORNIA PRIVACY LAW SPECIFIC PROVISIONS“CCPA” means the California Consumer Privacy Act of 2018 (“CCPA”), Cal. Civ. Code Section 1798.100, et seq., as may be amended from time to time (including but not limited to thoseamendments enacted by the California Privacy Rights Act of 2020 (“CPRA”)), and any implementing regulations relating to the same. Unless otherwise defined herein, all capitalized
terms in this Appendix 2 are as defined in the Agreement or the CCPA. Where the Personal Data is subject to requirements regarding Processing under the CCPA and/or CPRA in effectas at the Effective Date of this DPA, the following provisions shall apply:
Requirement

Provision applicable to DPA
See Sections 2.3.2 and 2.3.3. For this Appendix 2, “sell” and “share,” asused in the DPA, shall take the meanings assigned to those terms in the
CCPA.
.
Provision of SaaS Services, Professional Services and/or Support inaccordance with the Agreement and DPA. More specific information
available at Section 1.1.4
Verint shall Process the Personal Data only to achieve the Business
Purpose of Processing as set forth in the DPA (and may otherwise use
personal information solely as permitted under the CCPA).
See Sections 4.1 and 6.1. Moreover, each party shall comply withapplicable obligations under Privacy Laws

Prohibition on Selling or Sharing Personal Information
Business Purpose of Processing
Use Limitation
Compliance with CCPA
Notification of a determination it can no longer comply with Privacy Law

See Section 13.3

Non-combining of Personal Data as Service Provider

Verint agrees that it shall not combine Personal Data with other data it
receives from other sources about the same Data Subject except where
Verint is entitled to do so under Privacy Law, or pursuant to the Agreement
or this DPA or the business purpose

Written agreement with each Subprocessor

See Section 5.3.2

Maintain technical and organizational measures to protect Personal
Information

See Section 4.1

Certification Verint understands the restrictions

Verint certifies that it understands the restrictions set forth herein and under
the CCPA and will comply with them

Reasonable Support to Respond and Notice of any Requests

See Sections 6.1.1 and 6.2

Reasonable and Appropriate Steps to Ensure Compliance

See Section 10

Retention, Use or Disclosure of Personal Information

Verint will not retain, use, or disclose the Personal Information outside of thedirect business relationship and for any purpose other than providing theServices as specified in the Agreement and associated Orders, for a
Business Purpose, or as expressly permitted by the CCPA.

Right to Stop Unauthorized Use

See Section 13.4

Consumer Requests - Notices

See Section 6(REV 12JAN2024)

Copyright © Verint Systems Inc., all rights reserved.

6

APPENDIX 3
BRAZILIAN GENERAL DATA PROTECTION LAW (“LGPD”) TERRITORY SPECIFIC PROVISIONSLGPD applies regardless of where the data Processing agent is located, to the extent that: (i) the data Processing activities take place in Brazil, (ii) the data Processing
occurs for the offering of goods and services in Brazil, or for the Processing of Personal Data from Data Subjects located in Brazil; or (iii) the processed Personal Datais collected in Brazil. For purposes of the LGPD, the Personal Data will be deemed as collected in Brazil if the Data Subject was in Brazil at the time the data wascollected.
For purposes of the LGPD, the definition of “Data Controller” is the same of the Portuguese term “Controlador” and in the context of this DPA shall mean Customer.
The definition of “Data Processor” (or “Service Provider) is the same of the Portuguese term “Operador” and in the context of this DPA shall mean Verint. The definitionof “Data Protection Officer (DPO)” is the same of the Portuguese term “Encarregado de Dados”.
Where the Personal Data is subject to requirements regarding Processing under the Brazilian General Data Protection Law (Law No. 13,709 of 2018; hereby named
as “LGPD”) in effect as at the Effective Date of this DPA, the following provisions shall apply:
1.

The Standard Contractual Clauses for the purposes of this Appendix shall mean the EU Standard Contractual Clauses where the “EU Standard Contractual
Clauses” shall mean the standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679, as set out in theEuropean Commission’s Implementing Decision 2021/914 of 4 June 2021, as may be amended, replaced or superseded by the European Commission from time
to time as the modules Annexes and adapted by this Appendix 3. To the extent of any conflict between the body of this DPA and this Appendix 3 as it relates toProcessing falling under this Appendix 3, this Appendix 3 shall prevail of any conflicting term in the body of this DPA. Notwithstanding the foregoing, as requiredby clause 5 of the EU Standard Contractual Clauses, the EU Standard Contractual Clauses shall prevail over any other term of this DPA and the Agreement.

2.

In respect of any Restricted Transfers from Brazil, the parties agree to the following:
2.1. The EU Standard Contractual Clauses will be incorporated into this DPA. The EU Standard Contractual Clauses shall apply in respect of any RestrictedTransfer from Brazil to other jurisdictions, subject to amendments for adequacy with certain obligations specifically set forth in the Brazilian General Data
Protection Law, and to the extent that Brazilian Supervisory Authority (“ANPD”) does not set forth its specific Standard Contractual Clauses for RestrictedTransfers.
2.2. The modules and Annexes of the EU Standard Contractual Clauses are set out at https://www.verint.com/wp-content/uploads/Modules-to-SCC-pursuantto-Regulation-EU-2016-679.pdf; and2.3. The parties agree that execution of this DPA or the agreement into which it is incorporated constitutes signature and acceptance of Annex 1.A to thisAppendix 3 of this DPA and acceptance and incorporation of the EU Standard Contractual Clauses.

(REV 12JAN2024)

Copyright © Verint Systems Inc., all rights reserved.

7