GENERAL DATA PROCESSING ADDENDUM

This General Data Processing Addendum (“GDPA“) located at www.creatio.com/legal forms part of the Master
Subscription Agreement to which it is attached (the “Agreement”) by and between Customer and Company to reflect
the parties’ agreement with regard to the Processing of Personal Data, in consideration of the mutual covenants
and representations set forth in this GDPA, the parties hereby agree as follows.
Unless defined in this GDPA, all capitalized terms used herein shall have the meaning given to them in theAgreement. In the event of any conflict between the Agreement and this GDPA, the terms of this GDPA shallprevail in relation to the Processing of Personal Data s et out in this GDPA.
Customer enters into this GDPA on behalf of itself and, to the extent required under applicable Data Protection
Laws and Regulations, in the name and on behalf of its Authorized Affiliates, if and to the extent Company processes
Personal Data for which such Authorized Affiliates qualify as the Controller.
For the purposes of this GDPA only, and except where indicated otherwise, the term "Customer" shall include
Customer and its Authorized Affiliates. All capitalized terms not defined herein shall have the meaning set forth in
the Agreement.
DATA PROCESSING TERMS
1.
DEFINITIONSIn this GDPA, the following definitions apply:“Affiliate” means any entity that directly or indirectly controls, is controlled by, or is under common control
with the subject entity. “Control,” for purposes of this definition, means direct or indirect ownership or control
of more than 50% of the voting interests of the subject entity.
“Authorized Affiliate(s)” means any of Customer's Affiliate(s) which (a) is subject to the Data Protection
Laws and Regulations and (b) is permitted to use the Subscription Services pursuant to the Agreement, but
has not signed its own order form with Company and is not a "Customer" as defined under the Agreement.
“Controller” means the entity which determines the purposes and means of the Processing of Personal Data.
“Customer Data” means electronic data and information submitted by Customer in connection with the useof the Subscription Services.
“Data Protection Laws and Regulations” means all laws and regulations, including laws and regulationsof the European Union, the European Economic Area and their member states, Switzerland and theUnited Kingdom, including without limitation Regulation (EU) 2016/679 of the European Parliament and of
the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal
data and on the free movement of such data (“General Data P rotection Regulation” or “GDPR”) and EU
Directive 2002/58/EC on Privacy and Electronic Communications (“e-Privacy Directive”) or, the superseding
Regulation on Privacy and Electronic Communications (“e-Privacy Regulation”), once effective.
“Data Subject” means the identified or identifiable natural person, as defined under Data Protection Laws andRegulations, who can be identified, directly or indirectly, in particular by reference to an identifier such as aname, an identification number, location data, an online identifier or to one or more factors specific to thephysical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
“Personal Data” means any information relating to a Data Subject that is Processed by Company on behalf ofCustomer pursuant to the terms of the Agreement.
“Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss,
alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored or otherwise Processed byCompany.
“Process,” “Processes,” “Processed” or “Processing” means any operation or set of operations whichis performed upon Personal Data, whether or not by automatic means, such as collection, recording,organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure bytransmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or
destruction.
“Processor” means the entity which Processes Personal Data on behalf of the Controller.
“Sub-processor” means any Processor engaged by Company, or a group of its companies, in the provisionof the Subscription Services to Customer.

“Supervisory Authority” means an independent public authority, w h i c h is established by an EU Member
State pursuant to the GDPR.
2.
PROCESSING OF PERSONAL DATA
2.1 Roles of the Parties. The parties acknowledge and agree that, with regard to the Processing of Personal
Data, Customer is the Controller and appoints Company as the Processor and that Company or its Affiliates
may engage Sub-processors pursuant to the requirements set forth in Section 6 (“Sub-processors”) below..
Company does not have independent control over the Personal Data. Company processes the Personal
Data solely on the instructions of the Customer within the context of providing the Subscription Services, inline with the purposes and means provided by the Controller and the retention terms stated in main
Agreement, and in compliance with the applicable Data Protection Laws and Regulations..
2.2 Customer’s Processing of Personal Data. Customer shall, in its use of the Subscription Services,
Process Personal Data in accordance with the requirements of the Agreement and all Data Protection Laws
and Regulations. For the avoidance of doubt, Customer’s instructions for the Processing of Personal Data
shall comply with Data Protection Laws and Regulations. Customer shall have sole responsibility for theaccuracy, quality, and legality of Personal Data and the means by which Customer acquired Personal Data.
2.3 Company’s Processing of Personal Data. Company shall treat Personal Data as Confidential
Information and shall only Process Personal Data on behalf of, and in accordance with, Customer’s
documented instructions for the following purposes: (i) Processing in accordance with the Agreement andapplicable Order Form(s); (ii) Processing initiated by Customer’s end users in their use of the Subscription
Services; and (iii) Processing to comply with other documented, c o m m e r c i a l l y reasonable instructions
provided by Customer (e.g., via email), where such instructions are consistent with the terms of theAgreement. Company will not process the Personal Data any further than is provided in this clause 2.1.
Under no circumstances will Company use the Personal Data for its own purposes or exploit them (or havethem exploited) other than as permitted or authorized pursuant to th e terms of the Agreement.
2.4 Details of the Processing. The subject-matter of Processing of Personal Data by Company is theperformance of the Subscription Services pursuant to the Agreement. The duration of the Processing, thenature and purpose of the Processing, the types of Personal Data and categories of Data Subjects Processed
under this GDPA are further specified in Schedule 1 (Details of the Processing) to this GDPA.
2.5 Cross-Border Transfers. If Personal Data is transferred under the Agreement from the European Economic
Area or Switzerland by Customer as Controller to Company as Processor, or otherwise by Company as Processor,
to a jurisdiction which the European Commission or, where relevant, the Swiss Federal Data Protection andInformation Commissioner, has not determined ensures an adequate level of protection of Personal Data, thenCompany and Customer shall execute the Standard Contractual Clauses via the check box below.
3. NOTICES AND CONSENTS
3.1 General: Customer shall comply with all applicable Data Protection Laws and Regulations, including: (a)providing all required notices and appropriate disclosures to all Data Subjects regarding Customer’s, andCompany’s, Processing and transfer of Personal Data; and (b) obtaining all necessary rights and valid consentsfrom Data Subjects to permit Processing by Company for the purposes of fulfilling Company’s obligations, or asotherwise permitted, under the Agreement.
3.2 Children; Sensitive Data: Customer is responsible for compliance with all applicable Data Protection Laws
and Regulations regarding its content, including without limitation those that regulate content directed toward
children (as defined under applicable Data Protection Laws and Regulations; for example, under 13 years old in
the United States or under 16 years old in certain other countries). Customer’s use of Company Subscription
Services in connection with the distribution of content and/or Processing of sensitive Personal Data of a Data
Subject (such as racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union
membership, or an individual’s genetic data, biometric data, health data, or data regarding sex life or sexual
orientation) must be in compliance with all applicable Data Protection Laws and Regulations, including obtaining
express consent from Data Subjects whose Personal Data is provided to Company for Processing.
4.
RIGHTS OF DATA SUBJECTS
Company shall, to the extent legally permitted, promptly notify Customer if Company receives a request froma Data Subject to exercise the Data Subject's valid right of access, right to rectification, restriction ofProcessing, erasure (“right to be forgotten”), data portability, object to the Processing, or its right not to be
subject to an automated individual decision making, to the extent that such Data Subject is entitled to suchrights under applicable Data Protection Laws and Regulations (“Data Subject Inquiry”). Taking into accountthe nature of the Processing, Company shall assist Customer by appropriate technical and organizational
measures, insofar as this is possible, for the fulfilment of Customer’s obligation to respond to a Data Subject
Inquiry under Data Protection Laws and Regulations. In addition, to the extent Customer, in its use of the
Subscription Services, does not have the ability to address a Data Subject Inquiry, Company shall upon
Customer’s request provide commercially reasonable efforts to assist Customer in responding to such
Data Subject Inquiry, to the extent Company is legally permitted to do so and the response to such Data
Subject Inquiry is required under Data Protection Laws and Regulations. To the extent legally permitted,
Customer shall be responsible for any costs arising from Company’s provision of such assistance.
5.
COMPANY PERSONNEL
5.1 Confidentiality. Company shall ensure that its personnel engaged in the Processing of Personal Data
are informed of the confidential nature of the Personal Data, have received appropriate training on their
responsibilities and have executed written confidentiality agreements. Company shall ensure that suchconfidentiality obligations survive the termination of the personnel engagement.
5.2 Reliability. Company shall take commercially reasonable steps to ensure the reliability of any
Company personnel engaged in the Processing of Personal Data.
5.3 Limitation of Access. Company shall ensure that Company’s access to Personal Data is limited tothose personnel, including Sub-processors, providing Subscription Services in accordance with theAgreement. Company only grants its employees and Sub-processors access to the Personal Data insofar
as this is required for the performance of the Agreement and with due observance of the confidentiality
provisions.
6.
SUB-PROCESSORS
6.1 Appointment of Sub-processors. Customer acknowledges and agrees that (a) Company’s Affiliates
may be retained as Sub-processors; and (b) Company and Company’s Affiliates, respectively, may engage
third-party Sub-processors in connection with the provision of the Subscription Services. Company or its
Affiliate has entered into a written agreement with each Sub-processor containing data protection obligations
not less protective than those in this GDPA with respect to the protection of Personal Data to the extent
applicable to the nature of the services provided by such Sub-processor. A list of approved Sub-processors
as of the Effective Date of this GDPA is located at https://www.creatio.com/legal (the “Sub-processor List”).
Customer may subscribe to receive update alerts when changes are made to the Sub -processor List.
Company will inform Customer of any new Sub-processor engaged during the term of the Subscription Agreement
by updating the Sub-processor List.
6.2 Objection Right for New Sub-processors.. If Customer can reasonably show that the appointment of
a new Sub-processor will have a material adverse effect on Company’s ability to comply with applicable Data
Protection Laws and Regulations, then Customer must promptly notify Company in writing within fifteen (15)business days thereafter of its reasonable basis for objection to the use of a new Sub-processor. Upon
receipt of Customer’s written objection, Customer and Company will work together without unreasonable
delay to recommend an alternative arrangement. If the following conditions apply: a) a mutually a cceptable
and reasonable alternative arrangement is not found; b) Customer has a termination right under applicable
Data Protection Laws and Regulations, and c) Customer has provided prompt written notice under thisSection, then Customer may terminate the Subscription Agreement only with respect to those services thatcannot be provided by Company without the use of the new Sub-processor. Unless prohibited by applicable
Data Protection Laws and Regulations, in the event of such early termination by Custom er, Company canretain or require payment for Services through the end of Customer’s current contract term for the terminatedservices.
6.3 Liability. Company shall be liable for the acts and omissions of its Sub-processors to the same extent
Company would be liable if performing the Subscription Services of each Sub-processor directly under theterms of this GDPA, except as otherwise set forth in the Agreement.
7.
SECURITY
7.1 Controls for the Protection of Customer Data. Company shall maintain appropriate technical andorganizational measures for protection of the security (including protection against unauthorized or unlawful
Processing and against accidental or unlawful destruction, loss or alteration or damage, unauthorized
disclosure of, or access to, Customer Data), confidentiality and integrity of Customer Data. Company
regularly monitors compliance with these measures. Company will not materially decrease the overall
security of the Subscription Services during a subscription term.
7.2 Third-Party Certifications and Audits. Upon Customer’s written request at reasonable intervals, andsubject to the confidentiality obligations set forth in the Agreement, Company shall make available to
Customer that is not a competitor of Company (or Customer’s independent, third-party auditor that is not acompetitor of Company) a copy of Company’s then most recent third-party audits or certifications, asapplicable.
8.
CUSTOMER DATA INCIDENT MANAGEMENT AND NOTIFICATION
Company shall maintain security incident management policies and procedures and shall, notify Customer
without undue delay after becoming aware of any Personal Data Breach. Company shall make reasonable
efforts to identify the cause of such Personal Data Breach and take those steps as Company deems necessary
and commercially reasonable in order to remediate the cause of such a Personal Data Breach to the extent
the remediation is within Company’s reasonable control. The obligations herein shall not apply to incidents
that are caused by Customer or Customer’s end users.
9.
RETURN AND DELETION OF CUSTOMER DATA
Upon termination or expiration of the Agreement or at any time at Customer’s written request, Company shall:
return to Customer or destroy all Personal Data, except as otherwise permitted by applicable Data Protection
Laws and Regulations.
10. LIMITATION OF LIABILITY
Notwithstanding anything contained in this GDPA to the contrary, Customer’s remedies and Company’s andits Affiliates’ obligations, with respect to breach of this GDPA or a Personal Data Breach directly caused byCompany and the overall liability of Company arising out of, or in connection with such breach will be subject
to the aggregate limitations of liability under Section 9 of the Agreement (the “ Liability Cap”)
FOR THE AVOIDANCE OF DOUBT, THE PARTIES INTEND AND AGREE THAT THE OVERALLAGGREGATE LIABILITY OF COMPANY AND ITS AFFILIATES ARISING OUT OF, OR IN CONNECTION
WITH, COMPANY’S BREACH OF THIS GDPA SHALL IN NO EVENT EXCEED THE LIABILITY CAP.
11. EUROPEAN SPECIFIC PROVISIONS
11.1 Data Protection Impact Assessment. Upon Customer’s request, Company shall provide Customer withreasonable cooperation and assistance needed to fulfil Customer’s obligation under the GDPR to carry out adata protection impact assessment related to Customer’s use of the Subscription Services, to the extent
Customer does not otherwise have access to the relevant information, and to the extent such information isavailable to Company. COMPANY shall provide commercially reasonable assistance to Customer in thecooperation or prior consultation with the Supervisory Authority in the performance of its tasks relating to
Section 2.5 of this GDPA, to the extent required under the GDPR.
STANDARD CONTRACTUAL CLAUSES: If this box is checked, the contractual clauses set out in
Schedule 2 (“Standard Contractual Clauses”), which are pursuant to the European Commission’s decision(C(2010)593) of 5 February 2010, are incorporated herein and apply to the Processing of Personal Data of residentsof the European Union or Switzerland by Company in the course of providing Services to Customer under the
Agreement. The parties hereby agree that if a new version of the Standard Contractual Clauses is officially andformally adopted by the EU Commission pursuant to Article 28(7) of the GDPR, such new version shall
automatically, and without further action of the parties, replace the current version of the Standard Contractual
Clauses in Schedule 2, unless either party objects to such amendment by written notice to the other party, within
ninety (90) days after the official public announcement of such adoption by the EU Commission.

SCHEDULE 1 - DETAILS OF THE PROCESSING

NATURE AND PURPOSE OF PROCESSING
Company will Process Personal Data as necessary to perform the Subscription Services pursuant to theAgreement, as further specified in the Documentation, and as further instructed by Customer in its use of
the Subscription Services.
DURATION OF PROCESSING
Subject to Section 9 of the GDPA, Company will Process Personal Data for the duration of the Agreement,
unless otherwise agreed upon in writing.
CATEGORIES OF DAT A SUBJECTS
Customer may submit Personal Data to the Subscription Services, the extent of which is determined andcontrolled by Customer in its sole discretion, and which may include, but is not limited to Personal Data
relating to the following categories of data subjects:● Prospects, customers, business partners and vendors of Customer (who are natural persons)● Employees or contact persons of Customer’s prospects, customers, business partners and vendors● Employees, agents, advisors, freelancers of Customer (who are natural persons)● Customer’s Users authorized by Customer to use the Subscription Services
TYPE OF PERSONAL DATA
Customer may submit Personal Data to the Subscription Services, the extent of which is determined andcontrolled by Customer in its sole discretion, and which may include, but is not limited to the following
categories of Personal Data:● First and last name● Title● Position● Employer● Contact information (company, email, phone, physical business address)● ID data● Professional life data
● Personal life data
● Connection data
● Localisation data

SCHEDULE 2
STANDARD CONTRACTUAL CLAUSES (PROCESSORS)(pursuant to Article 26(2) of Directive 95/46/EC)
Contracting Creatio entity as may be specified in the Order Form or one of its affiliated companies (“Company”)(also referred to herein as “data importer”) and Customer (also referred to herein as “data exporter”) have enteredinto an agreement (the “Agreement”) pursuant to the terms of which Company and its affiliates may Process orstore certain Customer information on behalf of Customer and Customer’s customers, together with a General Data
Processing Addendum (“GDPA”) which incorporates the following Standard Contractual Clauses (also referred toherein as the “Clauses”) in order to adduce adequate safeguards with respect to the protection of privacy andfundamental rights and freedoms of individuals for the transfer by the data exporter to the data importer of Personal
Data of residents of the European Union or Switzerland for Processing under the Agreement.
Clause 1
Definitions
For the purposes of the Clauses:(a)'personal data', 'special categories of data', 'process/processing', 'controller', 'processor', 'data subject'and 'supervisory authority' shall have the same meaning as in Directive 95/46/EC of the European
Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to theprocessing of personal data and on the free movement of such data;(b)'the data exporter' means the controller who transfers the personal data;(c)'the data importer' means the processor who agrees to receive from the data exporter personal dataintended for processing on his behalf after the transfer in accordance with his instructions and the terms of
the Clauses and who is not subject to a third country's system ensuring adequate protection within themeaning of Article 25(1) of Directive 95/46/EC;(d)'the subprocessor' means any processor engaged by the data importer or by any other subprocessor ofthe data importer who agrees to receive from the data importer or from any other subprocessor of the data
importer personal data exclusively intended for processing activities to be carried out on behalf of the data
exporter after the transfer in accordance with his instructions, the terms of the Clauses and the terms of
the written subcontract;(e)'the applicable data protection law' means the legislation protecting the fundamental rights and freedoms ofindividuals and, in particular, their right to privacy with respect to the processing of personal dataapplicable to a data controller in the Member State in which the data exporter is established;(f)'technical and organisational security measures' means those measures aimed at protecting personal
data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure oraccess, in particular where the processing involves the transmission of data over a network, and against
all other unlawful forms of processing.
Clause 2
Details of the transfer

The details of the transfer and in particular the special categories of personal data where applicable are specified inAppendix 1 which forms an integral part of the Clauses.

Clause 3
Third-party beneficiary clause1.

The data subject can enforce against the data exporter this Clause, Clause 4(b) to (i), Clause 5(a) to (e),and (g) to (j), Clause 6(1) and (2), Clause 7, Clause 8(2), and Clauses 9 to 12 as third-party beneficiary.

2.

The data subject can enforce against the data importer this Clause, Clause 5(a) to (e) and (g), Clause 6,
Clause 7, Clause 8(2), and Clauses 9 to 12, in cases where the data exporter has factually disappeared or
has ceased to exist in law unless any successor entity has assumed the entire legal obligations of the data
exporter by contract or by operation of law, as a result of which it takes on the rights and obligations of thedata exporter, in which case the data subject can enforce them against such entity.

3.

The data subject can enforce against the subprocessor this Clause, Clause 5(a) to (e) and (g), Clause 6,
Clause 7, Clause 8(2), and Clauses 9 to 12, in cases where both the data exporter and the data importer
have factually disappeared or ceased to exist in law or have become insolvent, unless any successor entity
has assumed the entire legal obligations of the data exporter by contract or by operation of law as a result of
which it takes on the rights and obligations of the data exporter, in which case the data subject can enforce
them against such entity. Such third-party liability of the subprocessor shall be limited to its own processing
operations under the Clauses.

4.

The parties do not object to a data subject being represented by an association or other body if the data
subject so expressly wishes and if permitted by national law.
Clause 4
Obligations of the data exporter

The data exporter agrees and warrants:(a)that the processing, including the transfer itself, of the personal data has been and will continue to be
carried out in accordance with the relevant provisions of the applicable data protection law (and, whereapplicable, has been notified to the relevant authorities of the Member State where the data exporter isestablished) and does not violate the relevant provisions of that State;(b)that it has instructed and throughout the duration of the personal data processing services will instruct thedata importer to process the personal data transferred only on the data exporter's behalf and in accordancewith the applicable data protection law and the Clauses;(c)that the data importer will provide sufficient guarantees in respect of the technical and organisational
security measures specified in Appendix 1;(d)that after assessment of the requirements of the applicable data protection law, the security measures areappropriate to protect personal data against accidental or unlawful destruction or accidental loss,
alteration, unauthorised disclosure or access, in particular where the processing involves the transmissionof data over a network, and against all other unlawful forms of processing, and that these measures ensure
a level of security appropriate to the risks presented by the processing and the nature of the data to beprotected having regard to the state of the art and the cost of their implementation;(e)that it will ensure compliance with the security measures;(f)that, if the transfer involves special categories of data, the data subject has been informed or will be informed
before, or as soon as possible after, the transfer that its data could be transmitted to a third country notproviding adequate protection within the meaning of Directive 95/46/EC;(g)

to forward any notification received from the data importer or any subprocessor pursuant to Clause 5(b)and Clause 8(3) to the data protection supervisory authority if the data exporter decides to continue thetransfer or to lift the suspension;

(h)to make available to the data subjects upon request a copy of the Clauses, with the exception of Appendix
2, and a summary description of the security measures, as well as a copy of any contract for
subprocessing services which has to be made in accordance with the Clauses, unless the Clauses or thecontract contain commercial information, in which case it may remove such commercial information;(i)that, in the event of subprocessing, the processing activity is carried out in accordance with Clause 11 bya subprocessor providing at least the same level of protection for the personal data and the rights of data
subject as the data importer under the Clauses; and(j)that it will ensure compliance with Clause 4(a) to (i).
Clause 5
Obligations of the data importer

The data importer agrees and warrants:(a)to process the personal data only on behalf of the data exporter and in compliance with its instructions andthe Clauses; if it cannot provide such compliance for whatever reasons, it agrees to inform promptly thedata exporter of its inability to comply, in which case the data exporter is entitled to suspend the transfer
of data and/or terminate the contract;(b)that it has no reason to believe that the legislation applicable to it prevents it from fulfilling the instructions
received from the data exporter and its obligations under the contract and that in the event of a change inthis legislation which is likely to have a substantial adverse effect on the warranties and obligations provided
by the Clauses, it will promptly notify the change to the data exporter as soon as it is aware, in which casethe data exporter is entitled to suspend the transfer of data and/or terminate the contract;(c)that it has implemented the technical and organisational security measures specified in Appendix 2 before
processing the personal data transferred;(d)that it will promptly notify the data exporter about:(i)

any legally binding request for disclosure of the personal data by a law enforcement authority unlessotherwise prohibited, such as a prohibition under criminal law to preserve the confidentiality of alaw enforcement investigation,(ii)

any accidental or unauthorised access, and(iii)

any request received directly from the data subjects without responding to that request, unless it
has been otherwise authorised to do so;(e)to deal promptly and properly with all inquiries from the data exporter relating to its processing of thepersonal data subject to the transfer and to abide by the advice of the supervisory authority with regard to
the processing of the data transferred;(f)at the request of the data exporter to submit its data processing facilities for audit of the processing activities
covered by the Clauses which shall be carried out by the data exporter or an inspection body composed ofindependent members and in possession of the required professional qualifications bound by a duty ofconfidentiality, selected by the data exporter, where applicable, in agreement with the supervisory authority;(g)

to make available to the data subject upon request a copy of the Clauses, or any existing contract for
subprocessing, unless the Clauses or contract contain commercial information, in which case it may
remove such commercial information, with the exception of Appendix 2 which shall be replaced by asummary description of the security measures in those cases where the data subject is unable to obtain acopy from the data exporter;(h)that, in the event of subprocessing, it has previously informed the data exporter and obtained its prior writtenconsent;(i)that the processing services by the subprocessor will be carried out in accordance with Clause 11;

(j)to send promptly a copy of any subprocessor agreement it concludes under the Clauses to the data
exporter.
Clause 6
Liability

1.

The parties agree that any data subject, who has suffered damage as a result of any breach of the obligations
referred to in Clause 3 or in Clause 11 by any party or subprocessor is entitled to receive compensationfrom the data exporter for the damage suffered.

2.

If a data subject is not able to bring a claim for compensation in accordance with paragraph 1 against thedata exporter, arising out of a breach by the data importer or his subprocessor of any of their obligations
referred to in Clause 3 or in Clause 11, because the data exporter has factually disappeared or ceased toexist in law or has become insolvent, the data importer agrees that the data subject may issue a claim against
the data importer as if it were the data exporter, unless any successor entity has assumed the entire legal
obligations of the data exporter by contract of by operation of law, in which case the data subject can enforce
its rights against such entity.
The data importer may not rely on a breach by a subprocessor of its obligations in order to avoid its own
liabilities.

3.

If a data subject is not able to bring a claim against the data exporter or the data importer referred to inparagraphs 1 and 2, arising out of a breach by the subprocessor of any of their obligations referred to in
Clause 3 or in Clause 11 because both the data exporter and the data importer have factually disappearedor ceased to exist in law or have become insolvent, the subprocessor agrees that the data subject may issue
a claim against the data subprocessor with regard to its own processing operations under the Clauses as
if it were the data exporter or the data importer, unless any successor entity has assumed the entire legal
obligations of the data exporter or data importer by contract or by operation of law, in which case the data
subject can enforce its rights against such entity. The liability of the subprocessor shall be limited to its own
processing operations under the Clauses.
Clause 7
Mediation and jurisdiction

1.

2.

The data importer agrees that if the data subject invokes against it third-party beneficiary rights and/or
claims compensation for damages under the Clauses, the data importer will accept the decision of thedata subject:(a)to refer the dispute to mediation, by an independent person or, where applicable, by the supervisory
authority;(b)

to refer the dispute to the courts in the Member State in which the data exporter is established.

The parties agree that the choice made by the data subject will not prejudice its substantive or proceduralrights to seek remedies in accordance with other provisions of national or international law.
Clause 8
Cooperation with supervisory authorities

1.

The data exporter agrees to deposit a copy of this contract with the supervisory authority if it so requests
or if such deposit is required under the applicable data protection law.

2.

The parties agree that the supervisory authority has the right to conduct an audit of the data importer, and of
any subprocessor, which has the same scope and is subject to the same conditions as would apply to anaudit of the data exporter under the applicable data protection law.

3.

The data importer shall promptly inform the data exporter about the existence of legislation applicable toit or any subprocessor preventing the conduct of an audit of the data importer, or any subprocessor,
pursuant to paragraph 2. In such a case the data exporter shall be entitled to take the measures foreseen
in Clause 5 (b).
Clause 9
Governing Law

The Clauses shall be governed by the law of the Member State in which the data exporter is established.
Clause 10
Variation of the contract
The parties undertake not to vary or modify the Clauses. This does not preclude the parties from adding clauses
on business related issues where required as long as they do not contradict the Clause.
Clause 11
Subprocessing
1.

The data importer shall not subcontract any of its processing operations performed on behalf of the data
exporter under the Clauses without the prior written consent of the data exporter. Where the data importer
subcontracts its obligations under the Clauses, with the consent of the data exporter, it shall do so only
by way of a written agreement with the subprocessor which imposes the same obligations on the
subprocessor as are imposed on the data importer under the Clauses. Where the subprocessor fails to
fulfil its data protection obligations under such written agreement the data importer shall remain fully liable
to the data exporter for the performance of the subprocessor's obligations under such agreement.

2.

The prior written contract between the data importer and the subprocessor shall also provide for a thirdparty beneficiary clause as laid down in Clause 3 for cases where the data subject is not able to bring theclaim for compensation referred to in paragraph 1 of Clause 6 against the data exporter or the data
importer because they have factually disappeared or have ceased to exist in law or have become insolventand no successor entity has assumed the entire legal obligations of the data exporter or data importer bycontract or by operation of law. Such third-party liability of the subprocessor shall be limited to its own
processing operations under the Clauses.

3.

The provisions relating to data protection aspects for subprocessing of the contract referred to in paragraph1 shall be governed by the law of the Member State in which the data exporter is established.

4.

The data exporter shall keep a list of subprocessing agreements concluded under the Clauses and notified
by the data importer pursuant to Clause 5 (j), which shall be updated at least once a year. The list shall beavailable to the data exporter's data protection supervisory authority.
Clause 12
Obligation after the termination of personal data processing services

1.

The parties agree that on the termination of the provision of data processing services, the data importerand the subprocessor shall, at the choice of the data exporter, return all the personal data transferred andthe copies thereof to the data exporter or shall destroy all the personal data and certify to the data exporterthat it has done so, unless legislation imposed upon the data importer prevents it from returning or
destroying all or part of the personal data transferred. In that case, the data importer warrants that it will
guarantee the confidentiality of the personal data transferred and will not actively process the personal datatransferred anymore.
2.

The data importer and the subprocessor warrant that upon request of the data exporter and/or of thesupervisory authority, it will submit its data processing facilities for an audit of the measures referred to inparagraph 1.

APPENDIX 1 TO THE STANDARD CONTRACTUAL CLAUSES
This Appendix forms part of the Clauses

Data exporter: Customer
Data importer: contracting Creatio entity as may be specified in the Order Form and affiliates
Data subjects
The personal data transferred concern the following categories of data subjects: customers of Customer and anyother individuals interacting with the Company’s software and services, or as otherwise set forth or referenced in theAgreement and GDPA, or in any Orders or Statements of Work issued pursuant to the Agreement, or as otherwise
agreed by the parties.
Categories of data
The personal data transferred concern the following categories of data: as set forth or referenced in the Agreement
and GDPA, or in any Orders or Statements of Work issued pursuant to the Agreement, or as otherwise agreed by
the parties.
Special categories of data (if appropriate)
The personal data transferred concern the following special categories of data: None, unless otherwise specified in
the Agreement and GDPA, or in any Orders or Statements of Work issued pursuant to the Agreement, or asotherwise agreed by the parties.
Processing operations
The personal data transferred will be subject to the following basic processing activities: as set forth or referenced in
the Agreement and GDPA, or in any Orders or Statements of Work issued pursuant to the Agreement, or asotherwise agreed by the parties.

APPENDIX 2 TO THE STANDARD CONTRACTUAL CLAUSES
This Appendix forms part of the Clauses
Description of the technical and organizational security measures implemented by the data importer inaccordance with Clauses 4(d) and 5(c):As set forth or referenced in the Agreement and GDPA, or in any Orders or Statements of Work issued pursuant to theAgreement, or as otherwise agreed by the parties.