DATA PROCESSING ADDENDUM
WHEREAS NortonLifeLock Inc. and/or its affiliates (“NLOK”) has procured from Provider certain
products and/or services under the Agreement that involve the processing of Personal Data. NLOK andProvider are each a “Party” or the “Parties” to the Data Processing Addendum (“Addendum”) and to theattached Standard Contractual Clauses as listed in the Annex.
WHEREAS in this context:
NLOK acts as “Controller” and Provider acts as “Controller” with respect to the Personal Data;
The Parties agree as follows:
1. Definitions. Unless otherwise defined in the Agreement, all capitalized terms used in this Addendum
will have the meanings given to them below. If any definitions set forth herein or in the Agreement
conflict with statutory definitions provided in any applicable Data Protection Law, the definition in theapplicable Data Protection Law shall control.
"Applicable EU Legislation” means the General Data Protection Regulation (EU) 2016/679 of theEuropean Parliament and of the Council of 27 April 2016 on the protection of natural persons withregard to the processing of personal data and on the free movement of such data for the transfer of
personal data to a third country (“GDPR”) and, (iii) any applicable EU Member State Legislation.
“Controller” means the party which, alone or jointly with others, determines the purposes and meansof the Processing of Personal Data.
“Data Protection Law(s)” means the Applicable EU Legislation, the CCPA, and any other dataprotection laws which may be applicable to the Personal Data Processed under the Agreement.
“EEA” means the European Economic Area.
“Personal Data” means any information related to any identified or identifiable natural person (“DataSubject”), an identifiable natural person is one who can be identified, directly or indirectly, in particular
by reference to an identifier such as a name, an identification number, location data, an online identifier
or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural orsocial identity of that natural person, or as defined by the applicable Data Protection Law.
“Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction,
loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored, or otherwiseprocessed.
“Process” means any operation or set of operations which is performed on Personal Data or on sets of
Personal Data, whether or not by automated means, such as collection, recording, organization,structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission,
1
NortonLifeLock Data Processing Addendum
Click or tap here to enter text.

dissemination or otherwise making available, alignment or combination, restriction, erasure ordestruction.
“Processor” means a natural or legal person, public authority, agency, or other body which processespersonal data on behalf of the Controller.
“Services” means the services as described in the Agreement.
“Standard Contractual Clauses” means those clauses specified pursuant to the European
Commission Decision of 4 June 2021 on standard contractual clauses for the transfer of personal data
to third countries under the GDPR, a form of which is attached hereto as the Annex.
2. Compliance with Laws. Each Party will comply with the Data Protection Laws as applicable to it. To
the extent required by any Data Protection Law(s), the Parties agree to negotiate in good faith andexecute any such additional, supplemental or revised documents pertaining to the Processing ofPersonal Data as reasonably necessary for the provision of Services under the Agreement.
3. Data Processing. The Standard Contractual Clauses’ terms on data processing (i.e. module one:transfer controller to controller ) shall apply in a scenario where Personal Data is transferred between aController and a Processor within the EEA.
4. Provider Employees/Agents. Provider will restrict access to Personal Data solely to those employees
and agents who require such access to perform the Agreement, and Provider covenants and agrees thatthose employees/agents to whom it grants access to such Personal Data are or shall be: (i) directed tokeep such Personal Data confidential; and (ii) subject to written confidentiality obligations consistent
with the Agreement and applicable Data Protection Laws. Upon termination of any employee or agent,
Provider shall prohibit access to Personal Data and/or any systems that process Personal Data by theterminated employee/agent.
5. Data Breach Notification and Remediation. Provider will notify NLOK of the occurrence of a
Personal Data Breach without undue delay, taking into account: (i) the nature and gravity of the
Personal Data Breach; (ii) its potential consequences and/or adverse effects for a Data Subject; (iii)
NLOK’s obligation under Data Protection Laws to submit a breach notification to a data protection
regulator(s); and (iv) Provider’s obligations pursuant to the applicable Data Protection Laws and theStandard Contractual Clauses. Provider will send all notification of known or suspected breach of
Personal Data to: security@nortonlifelock.com
Except and only to the extent expressly required by law or pursuant to third-party agreements, Provider
agrees that it will not inform any third party that NLOK Personal Data has been involved in a Personal
Data Breach without NLOK’s prior written consent. If Provider is compelled by law or third partyagreement(s) to provide public/third-party notification of a Personal Data Breach, Provider will notidentity NLOK (directly or indirectly), and will use commercially reasonable efforts to obtain NLOK’sprior approval regarding the content of such disclosure to minimize any adverse impact to NLOK, andits respective customers and/or employees.
2NortonLifeLock Data Processing Addendum
Click or tap here to enter text.

6. Transfers/EEA+ Data Processing. Provider and its Processors and sub-processors shall only transfer
Personal Data to another country as legally permissible.
7. Standard Contractual Clauses(a) The Parties are deemed to have accepted and executed the standard contractual clauses (together,“Standard Contractual Clauses”) as follows:(i)in respect of UK Personal Data, the clauses for the transfer of personal data to processors
established in third countries which do not ensure an adequate level of protection for personal
data adopted by the European Commission under Commission Implementing Decision (EU)2021/914, including the text from modules one (Controller to Controller) and module four
(Processor to Controller) ("UK Standard Contractual Clauses"). Such clauses shall be
supplemented in respect of such transfers by template Addendum B.1.0 issued by the UK ICO
and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2February 2022, as it is revised under Section 18 of those mandatory clauses (the “UK ApprovedAddendum”) and Part 1 of the UK Approved Addendum shall be populated as set out below:
a. Table 1. The “start date” will be the date this DPA enters into force. The “Parties” are theNLOK as exporter and the Provider as importer.
b. Table 2. The “Addendum EU SCCs” are the modules and clauses of the Standard
Contractual Clauses in Commission Implementing Decision (EU) 2021/914, including thetext from module one and four of such clauses.
c. Table 3. The “Appendix Information” is as set out in the Schedules to this DPA.
d. Table 4. The exporter may end the UK Approved Addendum in accordance with its Section
19.
e. For the purposes of this DPA, “UK Personal Data” means the personal data to which dataprotection laws of the United Kingdom are applicable.

(ii)

in respect of EU Personal Data, the standard contractual clauses for the transfer of personal
data to third countries pursuant to the GDPR, adopted by the European Commission underCommission Implementing Decision (EU) 2021/914, including the text from modules one(Controller to Controller) and four (Processor to Controller) (“EU Standard ContractualClauses”). For the purposes of this DPA, “EU Personal Data” means the personal data to which
the Applicable EU Legislation is applicable. The EU Standard Contractual Clauses are deemed
to be completed with the information provided in this DPA and, in particular, the Schedules tothis DPA; and(iii)in respect of Swiss Personal Data, the EU Standard Contractual Clauses as deemed amended
by this DPA (the “Swiss Standard Contractual Clauses”), provided that any references in theclauses to the GDPR shall refer to the Federal Act on Data Protection (“FADP”), the term‘member state’ must not be interpreted in such a way as to exclude data subjects in Switzerland
3NortonLifeLock Data Processing Addendum
Click or tap here to enter text.

from the possibility of suing for their rights in their place of habitual residence in accordancewith clause 18(c) of the clauses, and the clauses shall also protect the data of legal persons until
the entry into force of the revised FADP. For the purposes of this DPA, “Swiss Personal Data”
means the personal data to which data protection laws of Switzerland are applicable. The Swiss
Standard Contractual Clauses are deemed to be completed with the information provided inthis DPA.
(b) The Provider agrees to execute additional documents (including updates to the Annexes of theStandard Contractual Clauses) and apply additional protections, as may be necessary under
Applicable EU Legislation in respect of transfers of Personal Data governed by this DPA.
(c) The parties agree that the Standard Contractual Clauses will be complied with as set out in thisDPA.
(d) Provider shall not permit its Processors or Sub-Processors to transfer any EEA+ Personal Dataoutside of the EEA or Switzerland other than as legally permissible and only to a country wherethe EEA+ Personal Data can be afforded essentially equivalent protections as are available in theEuropean Union. Provider shall execute such EU Standard Contractual Clauses as are applicable.
8. Data Protection Impact Assessment and Prior Consultation. Provider shall provide reasonableassistance to NLOK in regard to data protection impact assessments, and prior consultations withregulators or supervising authorities or other competent data privacy authorities, which NLOK
reasonably considers to be required by any applicable Data Protection Laws, in each case solely inrelation to Processing of Personal Data by, and taking into account the nature of the Processing andinformation available to, the Provider.

9. Order of Precedence. If there is a conflict between the Agreement and this Addendum, the terms ofthis Addendum will control including the terms of the Standard Contractual Clauses.
Attachments: Appendices 1-4 – Standard Contractual Clauses

4
NortonLifeLock Data Processing Addendum
Click or tap here to enter text.

ANNEX I
A. LIST OF PARTIES
Data exporter(s): [Identity and contact details of the data exporter(s) and, where applicable, of its/theirdata protection officer and/or representative in the European Union]
Name: ___________________________________________
Address: _________________________________________
Contact person’s name, position and contact details: ____________________________________________________________________________________________
Activities relevant to the data transferred under these Clauses:______________________________________________________________________________________________________________________________________
Signature and date: ___________________________________________________
Role (controller/processor):
2. …

Data importer(s): [Identity and contact details of the data importer(s), including any contact person withresponsibility for data protection]
Name: ___________________________________________
Address: _________________________________________Contact person’s name, position and contact details: ____________________________________________________________________________________________
Activities relevant to the data transferred under these Clauses:______________________________________________________________________________________________________________________________________
Signature and date: ___________________________________________________
Role (controller/processor):
2. …

5NortonLifeLock Data Processing Addendum
Click or tap here to enter text.

B. DESCRIPTION OF TRANSFER
Categories of data subjects whose personal data is transferred

Categories of personal data transferred

Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into
consideration the nature of the data and the risks involved, such as for instance strict purpose limitation,access restrictions (including access only for staff having followed specialised training), keeping a recordof access to the data, restrictions for onward transfers or additional security measures.

The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis).

Nature of the processing

Purpose(s) of the data transfer and further processing

The period for which the personal data will be retained, or, if that is not possible, the criteria used todetermine that period

For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing

C. COMPETENT SUPERVISORY AUTHORITY
Data Protection Commission, Ireland

6
NortonLifeLock Data Processing Addendum
Click or tap here to enter text.

ANNEX IITECHNICAL AND ORGANISATIONAL MEASURES INCLUDING TECHNICAL AND
ORGANISATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA
The data importer shall procure that its processors and/or subprocessors shall adopt physical, technical,and organizational security measures in accordance with industry best practices and standards and be incompliance with all applicable legal and regulatory requirements as they apply to the personal datatransferred under these Standard Contractual Clauses. Further, transmission and storage of personal data
to and from NortonLifeLock and third parties must be performed using NIST or PCI approved encryption
and hashing standards (e.g., SSH, SSL, TLS).
The data importer shall ensure its processors and/or subprocessors shall maintain a comprehensive
Information Security Program (ISP) including an Information Security Policy consisting of, at aminimum, standards to address annual security risk assessments, human resources security, assetmanagement, access controls, cryptography, physical and environmental security, operations security,communications security, system acquisition, development and maintenance, third party management,
information security incident management, and business continuity management in accordance with
NortonLifeLock’s Master Provider Security Requirements (MPSR).

7
NortonLifeLock Data Processing Addendum
Click or tap here to enter text.