PERSONAL DATA PROTECTION AGREEMENT FOR ESI GROUP PRODUCTS AND SERVICES
The conditions relating to the protection of personal data ("the Agreement") are agreed between the entity ESI("ESI") and the client ("Client"), both designated in the contract signed between the parties (the "Contract").
ARTICLE 1 - SCOPE AND HIERARCHY OF DOCUMENTS
The Agreement applies to the processing of personal data carried out by ESI acting as a subcontractor for the Client
in respect of the services provided (the "Services") under the Contract.
The Agreement consists of the present contractual terms and the appendices. It forms an integral part of the Contract.
In the event of any conflict within the Agreement, the appendices to the Agreement shall prevail over thecontractual terms of the Agreement. In the event of any conflict between the Contract and the Agreement, theAgreement shall prevail over the Contract.
The Agreement describes the rights and obligations of the Client and ESI with regard to the protection of Personal
Data in respect of the processing operations referred to in the appended Agreement. All other rights and obligations
relating to the Services are governed exclusively by the Agreement.
ARTICLE 2 - COMPLIANCE WITH THE LAW
The Client and ESI shall comply with the laws and regulations on the protection of personal data directly applicableto the Services.
ESI is responsible for its compliance with regulations as a subcontractor of the Client within the meaning of said
applicable regulations. For its part, the Client is considered to be the data controller within the meaning of theaforementioned applicable regulations.
The Client is responsible for complying with all laws and regulations applicable to the Client's use of the Services
and for ensuring that ESI is authorized to process personal data relating to the Services.
ARTICLE 3 - DURATION AND TERMINATIONThe Agreement has the same duration as the Contract.
Upon expiry of the Agreement, and unless otherwise agreed between the parties to the Agreement, ESI will delete
all personal data made available to it or obtained or generated by it on behalf of the Client in connection with theServices.
ARTICLE 4 - PROCESSING DETAILS
Details of the processing operations provided by ESI, including the purpose of the processing, the nature andpurpose of the processing, the types of personal data processed and the categories of data subjects, are set out inAnnex 1 to the Agreement.
ARTICLE 5 - DOCUMENTED INSTRUCTIONS
ESI will only process Personal Data in accordance with the Client 's documented instructions. The Client agrees that
the Contract and the Agreement constitute the Client 's documented instructions to ESI for the processing of
Personal Data.
Any additional or alternative instructions must be agreed in writing between the parties.
ARTICLE 6 - CONFIDENTIALITY OF PROCESSING
ESI will ensure that the personnel responsible for processing personal data :•preserves the confidentiality of said data,•processes said data in the manner described in the documented instructions (referred to above),

November 2023- Page 1 of 10•

has received adequate training in personal data protection.

ARTICLE 7 - TECHNICAL AND ORGANIZATIONAL MEASURES
Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposesof the processing, as well as the risk of varying probability and seriousness for the rights and freedoms of natural
persons, ESI implements the appropriate technical and organizational measures to guarantee a level of security
appropriate to the risk associated with the performance of the Services.
The technical and organizational measures implemented by ESI to this end are described in Appendix 2 of theAgreement.
The Client understands and accepts that technical and organizational measures are subject to the state of the art
and therefore to technical progress and development. ESI is therefore entitled to implement appropriate alternative
measures, provided that the security level of the measures is maintained.
For its part, the Client is responsible for implementing and maintaining appropriate technical and organizational
measures for the elements it provides or controls, such as implementing physical and system access control
measures for its own premises, assets and IT systems or configuring the Services to the Client 's individual needs.
ARTICLE 8 - FURTHER SUBCONTRACTING
The Client approves ESI's engagement of subsequent subcontractors. Subsequent Subcontractor" means any
subcontractor engaged by ESI and having access to the Client's personal data.
An updated list of Subsequent Subcontractors is available in Appendix 3 of the Agreement. ESI may remove or add
new Subcontractors at any time.
If required by applicable data protection law, ESI will obtain the Client's consent to engage new Subsequent
Subcontractors in accordance with the following procedure:
1) ESI will inform the Client, according to the information provided by the Client, as indicated below, at least 30
days in advance before authorizing a new Subsequent Subcontractor to access the Client's personal data;
2) If the Client does not raise any reasonable objection including an explanation of the reasons for non-approvalin writing within this 30-day period, this shall be deemed to be approval of the new Subsequent Subcontractor;
3) If the Client has reasonable objections, ESI will, before authorizing the Third-Party Processor to access the
Personal Data, endeavor too(a) recommend a change in the Client's configuration or use of the Services in order to avoid theprocessing of personal data by the new Third-Party Processor concernedoor (b) propose other measures that address the concerns raised in the Client's objection;4) If the proposed modifications or measures cannot eliminate the reasons for non-approval, the Client may
terminate the Contract for the Services concerned without penalty with 14 days' written notice following ESI's
response to the Client's objection. If the Client does not terminate the relevant offer within the 14-day period,
this shall constitute approval of the Subsequent Subcontractor by the Client.
If Subsequent Subcontractors are used, ESI will enter into an agreement with such Subsequent Subcontractors
imposing appropriate contractual obligations on the Subcontractor that are no less protective than the obligations
set forth in the Agreement. ESI shall remain liable for any acts or omissions of its Third-Party Subcontractors to thesame extent as for its own acts and omissions hereunder.
Notifications regarding Subsequent Subcontractors under the "Subsequent Subcontracting" section of theAgreement may be given by listing Subsequent Subcontractors at Data Privacy Terms for Clients (esigroup.com)and providing the Client with a mechanism to obtain notification of any new Subsequent
Subcontractors. It is the Client's responsibility to register a point of contact to receive notifications regarding
Subcontractors at Data Privacy Terms for Clients (esi-group.com) and to keep the contact information for

November 2023- Page 2 of 10

notifications up to date.
ARTICLE 9 - INTERNATIONAL DATA TRANSFERS
Transfer of personal data within the EU and EEA or to a country recognized as adequate by the EU
In the event of a transfer of personal data :- (i) within the EU or EEA or- (ii) to a country recognized as suitable by the EU
between the Client and ESI or between ESI and its Subcontractors, data protection is governed by the European
regulations applicable to personal data: the European General Data Protection Regulation.
The transfer of personal data will therefore be subject to the provisions of the Agreement and the Contract.
Transfer of personal data outside the EU or EEA without an adequacy decision
Data controllers and processors may transfer data outside the European Union ("EU") and the European Economic
Area ("EEA") provided that they ensure a sufficient and appropriate level of data protection.
Any transfer of personal data made in such a case will be subject to the Standard Contractual Clauses for Data
Protection adopted by the European Commission (the "SCC"), thus providing the appropriate guarantee for such atransfer of personal data.
Data transfers between the Client and ESI :If the ESI entity, party to this Agreement and the Contract, is located outside the EEA or outside a country subject
to an adequacy decision, then ESI and the Client hereby enter into Module 2 of the SCC.
If the Client itself acts as a subcontractor for its authorized entities, the Parties hereby also enter into Module 3 of
the SCC.
To this end, the standard contractual clauses available for their modules 2 and 3 at the European Commission's
address https://eur-lex.europa.eu/legal-content/FR/TXT/PDF/?uri=CELEX:32021D0914 are incorporated into theAgreement by reference. It is understood between the Parties that the optional clauses and articles do not apply
within the framework of the Agreement.
Annexes 1, 2 and 3 of the Agreement constitute respectively Annexes I to III of the SCC.
It is agreed between the Parties as follows:- The optional article 7 of the SCC, the "Membership Clause", is not incorporated herein;- Application of option 2 of article 9 ;- The optional wording of article 11 of the SCC is not incorporated herein;- According to article 17 of the SCC, the parties agree that the EU SCC is governed by French law and choose
option 2 to this effect;- Under article 18 of the SCC, the data exporter and importer agree that any dispute will be resolved by the
French courts. The term "Member State", as used in the SCC, should not be interpreted in such a way as to
exclude data subjects in Switzerland from asserting their rights in their place of habitual residence(Switzerland) in accordance with clause 18 in the SCC;
Data transfer between ESI and its subcontractors :ESI is responsible for concluding with its Subsequent Subcontractors the SCC opening the relevant processing
activities for the relevant Services.
Without prejudice to the legal rights of the persons concerned, the limitations of liability contained in the Agreement
also apply to the liability of ESI and its Subsequent Subcontractors to the Client under the SCC.
ARTICLE 10 - RIGHTS OF PERSONS CONCERNED
To the extent permitted by law, ESI will inform the Client as soon as possible if ESI receives a request from a data

November 2023- Page 3 of 10

subject to exercise his or her rights (such as the right of access, rectification, erasure or restriction of processing).
Given the nature of the processing and the information available to ESI, ESI reasonably assists the Client withappropriate technical and organizational measures, to the extent possible, for the fulfillment of the Client's
obligation to respond to requests to exercise the rights of the data subject.
ARTICLE 11 - THIRD-PARTY ACCESS REQUESTS
If ESI receives an order from a third party to disclose the Client's personal data, ESI :1) will endeavour, wherever possible, to redirect the third party to request the data directly from the Client;2) will promptly inform the Client, unless prohibited by applicable law, and, if prohibited from informing the
Client, will do everything legally possible to obtain the right to waive the prohibition in order tocommunicate as much information as possible to the Client as soon as possible;3) will use all legitimate and reasonable efforts to challenge the disclosure order on the basis of any legal
deficiencies under the laws of the requesting party or any relevant conflict with applicable law.
ARTICLE 12 - VIOLATION OF PERSONAL DATA
ESI will inform the Client as soon as possible of any breach of the Client's personal data.
Breach" means a breach of security resulting in the accidental or unlawful destruction, loss, alteration,
unauthorized disclosure of or access to personal data transmitted, stored or otherwise processed.
ESI will reasonably assist the Client in complying with its obligations in respect of personal data breaches inaccordance with applicable data protection legislation and will take necessary and reasonable remedial action.
ARTICLE 13 - AUDITS
Subject to a right of control of public order being provided for by the applicable law on the protection of personaldata, the Client has the right to control, by appropriate means, the compliance of ESI and its Subsequent
Subcontractors with the obligations relating to the protection of personal data. These audits are limited to theinformation and personal data processing systems that are relevant to the provision of the Services to the Client
and are limited to one audit per year.
In order to comply with the Client's imperative right to audit, ESI and its Subcontractors may call upon auditors(internal or external) to carry out audits in order to verify compliance with obligations relating to the protection of
personal data. Each audit results in an audit report ("Audit Report"). At the Client's request, ESI will provide therelevant Audit Reports for the Services concerned.
The Client agrees that such Audit Reports shall be used primarily for the purpose of exercising the Client's right ofaudit provided for in this Article.
If required by applicable data protection law, ESI will authorize additional audits to such Audit Reports, including
on-site audits at ESI's facilities and premises by the Client or an independent, accredited third party, during normal
business hours, with reasonable notice to ESI (in excess of four business days).
Audit Reports and any other information or documentation provided in the course of an audit constitute confidential
information and may only be provided to additional auditors under confidentiality obligations substantiallyequivalent to the confidentiality obligations contained in the Contract and the Agreement.
If the audits involve Subsequent Subcontractors, ESI may require the Client and its prospective auditors to enter
into non-disclosure agreements directly with the relevant Subsequent Subcontractor prior to transmitting the Audit
Reports and any other information or documentation to the Client.
ARTICLE 14 - MISCELLANEOUS PROVISIONS
If ESI provides a translation of the English version of the Agreement, the English version of the Agreement shallprevail in the event of any conflict.

November 2023- Page 4 of 10

ESI will update the Agreement regularly to maintain compliance with applicable regulations. Any changes will be
posted on this page with an updated revision date. In the event of substantial modifications, ESI will notify the Clientby any means.

November 2023- Page 5 of 10

APPENDIX I - DESCRIPTION OF PROCESSING OPERATIONS(and, where applicable, Appendix 1 of the SCC)
This annex specifies the processing operations covered by the Agreement (including, but not limited to, thepurpose of the processing, the nature and purpose of the processing, the type of personal data and the categoriesof data subjects).
A.

PARTS LIST

The Client (and, where the standard contractual clauses apply, the data exporter) :Name, address and contact person's name, position and contact details: The Client's name and address and thecontact details of a contact person are included in the Contract and/or are collected as part of the Client's
integration process.
Role (controller/processor): The Client acts as controller for the processing activities provided by ESI in respect of
the Client and, where applicable, as subcontractor under the instructions of its own data controllers.
The Service Provider (and, where standard contractual clauses apply, the data importer) :Name, address and name of contact person, function and contact details: The Provider / data importer providing
the processing services hereunder is the ESI GROUP entity specified in the Agreement.
The contact point for questions relating to data protection is the ESI GROUP Data Protection Officer:
dataprotection@esi-group.com
Role (controller/processor): ESI acts as a processor processing personal data on behalf of the Client and, whereapplicable, the Client's other data controllers.
B.
DESCRIPTION OF TRANSFER/PROCESSING OPERATIONS
Categories of data subjects whose personal data are transferred/processed
The persons concerned are as follows:• employees of the Client,• the Client's service providers,• students if the Client is an academic entity.
Categories of personal data transferred
The personal data transferred/processed concern the following categories of personal data:• contact and user information, including name, address, telephone number, e-mail address and time zone;• system access, use, authorization data, operating data and any system log files containing personal data or any
other data specific to the use by users of ESI software products; and• where applicable, other personal data determined by the Client (and its other data controllers where applicable)
by uploading or otherwise providing access to such data through the Services.
Sensitive data transferred (if applicable)
The Services are not intended for the processing of sensitive personal data. The Client (and its other data controllers,
where applicable) will not transmit, directly or indirectly, such sensitive personal data to ESI.
Frequency of transfer (for example, whether data is transferred on a one-off or continuous basis)If the Service performed involves the provision of professional services (as specified below), ESI may only access
Personal Data in connection with the provision of the Service in question, unless otherwise specified in theAgreement.

November 2023- Page 6 of 10

Nature of processing and purpose(s) of data transfer and further processing
ESI and its Subcontractors will process personal data for the proper performance of the Services provided under theContract.
How long the personal data will be kept or, if this is not possible, the criteria used to determine this period.
Personal data is kept for the duration of the Contract.
The Client may rectify, delete or restrict the processing of personal data through the functionalities of the Services.
ESI may also rectify, delete or restrict the processing of personal data in accordance with the Client's instructions.
For transfers to Third-Party Processors, please also specify the purpose, nature and duration of the processing.
The purpose, nature and duration of the treatment are specified in Annex III of the Agreement.
C.

Where SCC applies : COMPETENT CONTROL AUTHORITY

Where the SCC applies, the Client's supervisory authority acts as the competent supervisory authority under the SCC. A
list of EU supervisory authorities is available at the following address: https://ec.europa.eu/justice/article29/structure/data-protection-authorities/index_en.htm

November 2023- Page 7 of 10

APPENDIX II - TECHNICAL AND ORGANIZATIONAL MEASURES(and, where applicable, Appendix 2 of the SCC)
This document describes the technical and organizational measures implemented by ESI and its Subcontractors
to protect their IT systems and applications.
ESI is ISO 27001 certified, including the following key technical and organizational measures:-Access and rights management :-Access to personal data is
restricted to those who need it to perform their duties.
Implement access control mechanisms such as strong passwords, password rotation policies and two-factor
authentication.
-Data encryption/encryption to protect personal data, especially when transmitted over networks or stored
on physical media.
-Security incident management and response plans, including procedures for notifying and managing
personal data breaches.
Staff training and awareness-raising on data protection principles, information security best practices andthe consequences of non-compliance with the RGPD.
-Risk assessment and implementation of risk mitigation measures.
-Data retention policies-Physical protection:/Physical security measures to protect the premises where personal data is stored,such as alarm systems, access controls and surveillance cameras.
•

Management of service providers via data processing agreements to define the responsibilities of eachparty.

November 2023- Page 8 of 10

APPENDIX III - LIST OF APPROVED SUBCONTRACTORS(and, where applicable, Appendix 3 of the SCC)
In accordance with the provisions of the Agreement, the list of Subsequent Subcontractors is available at thefollowing address Data Privacy Terms for Clients (esi-group.com).
For each Third-Party Processor, the list includes the name, address and contact details of the contact person, as
well as a description of the associated processing.

November 2023- Page 9 of 10

APPENDIX IV: NATIONAL LEGAL SPECIFICITIESUNITED KINGDOMWith regard to transfers of personal data from the United Kingdom, the SCC will apply subject to the followingchanges:- the SCC are amended as specified in Part 2 of the International Data Transfer Endorsement to the European
Commission's standard contractual clauses issued under Section 119A of the UK Data Protection Act 2018,as it may be amended or replaced at any time (the "UK Endorsement") ;- the information contained in tables 1 to 3 of part 1 of the British Rider corresponds respectively to that
contained in the Rider and the Contract (as the case may be); and- table 4 of part 1 of the British Rider is completed by selecting "neither party".
UNITED STATES
If ESI processes personal data of U.S. residents, it makes the following additional undertakings to the Client: ESI willprocess personal data on behalf of the Client and will not retain, use or disclose it for purposes other than those set
forth in the Contract and Agreement as permitted by U.S. data protection law.
These Additional Terms do not limit or reduce ESI's privacy commitments to Client under the Agreement or theContract between ESI and Client. ESI hereby certifies that it understands and will comply with the restrictions
contained herein.
BRAZIL
Each Party undertakes to :- fulfill its obligations under the Brazilian General Data Protection Law, nº 13.709 de 2018 (Lei Geral deProteção de Dados Pessoais) ("LGPD") ;- keep a register of the personal data processing operations it carries out;
- appoint a data protection officer; and- adopt security, technical and administrative measures to protect personal data against unauthorized access,destruction, loss, alteration, accidental or unlawful disclosure or any form of inappropriate or unlawfulprocessing, including applicable minimum technical standards as defined by the national authority.
To the extent that the Client transfers personal information from Brazil to ESI, established outside Brazil, ESI willcomply with the principles, data subject rights and data protection regime provided by the GDPR, unless the Parties
can rely on another mechanism or basis for transfer under data protection laws.

November 2023- Page 10 of 10