PERSONAL DATA PROTECTION AGREEMENT – PARTNERS & SERVICE PROVIDERS
ESI (Controller) – Co-contractor (Processor)(Online version)
This personal Data Protection Agreement ("the DPA") are agreed between the entity ESI ("ESI") and the Cocontractor ("Co-contractor"), both designated in the contract signed between the Parties (the "Contract").
PURPOSE:
Under the terms of the Contract, the Parties are required to process personal data.
The Co-contractor is committed to protecting the privacy and data security in compliance with applicable dataprotection laws and regulations.
ARTICLE 1 - SCOPE AND HIERARCHY OF DOCUMENTS
The DPA applies to the processing of personal data carried out by the Co-contractor acting as a processor for ESI inrelation to the services provided (the "Services") under the Contract.
The DPA consists of these contractual terms and conditions and the appendices. It forms an integral part of theContract. In the event of any conflict within the DPA, the Annexes to the DPA shall prevail over the contractual termsof the DPA. In the event of any conflict between the Contract and the DPA, the DPA shall prevail over the Contract.
The DPA describes the rights and obligations of the Co-contractor and ESI with regard to the protection of personal
data concerning the processing operations referred to in the attached DPA. All other rights and obligations relating
to the Services are governed exclusively by the Contract.
ARTICLE 2 - COMPLIANCE WITH THE LAW
The Co-contractor and ESI will comply with the laws and regulations on the protection of personal data directly
applicable to the Services.
The Co-contractor is responsible for its compliance with the regulations as a processor of ESI within the meaning ofthe said applicable regulations. For its part, ESI is considered to be the data controller within the meaning of theaforementioned applicable regulations.
ARTICLE 3 - DURATION AND TERMINATIONThe DPA has the same duration as the Contract.
Upon expiry of the Contract, and unless otherwise agreed between the Parties to the Contract, the Co-contractor
will delete all personal data made available to it or obtained or generated by it on behalf of ESI in the context of theServices.
ARTICLE 4 - PROCESSING DETAILS
Details of the processing operations provided by the Co-contractor, including the purpose of the processing, thenature and purpose of the processing, the types of personal data processed and the categories of data subjects, areset out in Appendix 1 of the DPA.
The Co-contractor shall not process personal data for any purpose other than what is consented to by ESI or as
required by law.
ARTICLE 5 - DOCUMENTED INSTRUCTIONSThe Co-contractor will only process Personal Data in accordance with ESI's documented instructions. The Contract
and the DPA constitute ESI's documented instructions to the Co-contractor for the processing of Personal Data.
Any additional or alternative instructions must be agreed in writing between the Parties.

DPA ESI (Controller) – Co-contractor (Processor) - Avril 2024 - Page 1 of 9

ARTICLE 6 - CONFIDENTIALITY OF PROCESSING
The Co-contractor will ensure that the staff responsible for processing personal data :•preserves the confidentiality of said data,•processes the said data in the manner described in the documented instructions (referred to above),•has received appropriate training in the protection of personal data.

ARTICLE 7 - TECHNICAL AND ORGANISATIONAL MEASURES
Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposesof the processing, as well as the risk of varying probability and seriousness for the rights and freedoms of natural
persons, the Co-contractor implements the appropriate technical and organizational measures to guarantee a levelof security appropriate to the risk linked to the performance of the Services.
Co-contractor shall in relation to the concerned Personal Data implement appropriate technical and organizational
measures to ensure a level of security appropriate to that risk, including, as appropriate, the measures referred toin Article 32(1) of the GDPR.
The technical and organizational measures implemented by the Co-contractor for this purpose are described inAppendix 2 of the DPA.
The technical and organizational measures are subject to the state of the art and therefore to technical progress. As
a result, the Co-contractor is entitled to implement appropriate alternative measures, as long as the level of securityof the measures is maintained.
For its part, ESI is responsible for implementing and maintaining appropriate technical and organizational measures
for the items it provides or controls, such as implementing physical and system access control measures for its own
premises, assets and IT systems or configuring the Services to ESI's individual requirements.
ARTICLE 8 - SUBSEQUENT SUBCONTRACTING
The Co-contractor acknowledges and accepts that it may not call upon a subsequent sub-contractor (hereinafterreferred to as the "Subsequent Sub-Contractor") to process concerned personal data without having first obtained
ESI's explicit written authorization.
In the event of authorization being granted in accordance with the preceding provision, the Co-contractor
undertakes to impose on the Subsequent Sub-contractor the same level of protection of personal data as that initiallyagreed between ESI and the Co-contractor, in accordance with the requirements of the General Data Protection
Regulation (GDPR) and applicable data protection laws.
The Co-contractor remains fully responsible for all the activities of the Subsequent Sub-contractor with regard to theprocessing of concerned personal data. The Co-contractor undertakes to indemnify and hold harmless ESI for any
breach by the Subsequent Sub-contractor of any legal or contractual obligations relating to this DPA.
ARTICLE 9 - INTERNATIONAL DATA TRANSFERS
9.1 Transfer of personal data within the EU and the EEA or to a country recognized as adequate by the EU
In the event of a transfer of personal data :- (i) within the EU or EEA or- (ii) to a country recognized as suitable by the EU
between the Co-contractor and ESI or between the Co-contractor and its Subsequent Sub-contractor, theprotection of personal data is governed by the European regulations applicable to personal data: the European
General Data Protection Regulation.
The transfer of personal data will therefore be subject to the provisions of the DPA and the Contract.
9.2

Transfer of personal data from the EU to a country outside the EU or the EEA without an adequacy decision

DPA ESI (Controller) – Co-contractor (Processor) - Avril 2024 - Page 2 of 9

Data controllers and processors may transfer data outside the European Union ("EU") and the European Economic
Area ("EEA") provided that they ensure a sufficient and appropriate level of data protection.
Any transfer of personal data made in such a case will be subject to the Standard Contractual Data Protection
Clauses adopted by the European Commission (the "SCC"), thus providing the appropriate guarantee for such atransfer of personal data.
Data transfers between the Co-contractor and ESI :If the Co-contractor, a party to this DPA and the Contract, is located outside the EEA or outside a country subject toan adequacy decision, then ESI and the Co-contractor hereby enter into Module 2 of the SCC.
If ESI itself acts as a subcontractor for its own authorized entities, the Parties hereby also enter into Module 3 ofthe SCC.
To this end, the standard contractual clauses available for Modules 2 and 3 at the European Commission's address
L_2021199EN.01003101.xml (europa.eu) are incorporated into the DPA by reference. It is understood between
the Parties that the optional clauses and articles do not apply within the framework of the DPA.
Annexes 1, 2 and 3 of the DPA constitute respectively Annexes I to III of the SCC.
The Parties agree on the following details:- Optional Article 7 of the SCC, the "Membership Clause", is not incorporated herein;- Application of option 1 of Article 9 ;- The optional wording of Article 11 of the SCC is not incorporated herein;- In accordance with Article 17 of the SCC, the parties agree that the EU SCC shall be governed by French law
and select Option 2 to this effect;- Under Article 18 of the SCC, the data exporter and data importer agree that any dispute will be resolved by
the French courts. The term "Member State" as used in the SCC should not be interpreted to exclude data
subjects in Switzerland from asserting their rights in their place of habitual residence (Switzerland) inaccordance with clause 18 in the SCC;
Transfer of data between the Co-contractor and its Subsequent Sub-contractor:
It is the responsibility of the Co-contractor to conclude with its Subsequent Sub-contractor the SCC opening therelevant processing activities for the relevant Services.
Without prejudice to the legal rights of the persons concerned, the limitations of liability contained in the DPA also
apply to the liability of the Co-contractor and its Subsequent Subcontractors to ESI under the SCC.

DPA ESI (Controller) – Co-contractor (Processor) - Avril 2024 - Page 3 of 9

ARTICLE 10 - RIGHTS OF THE PERSONS CONCERNEDInsofar as permitted by law, the Co-contractor will inform ESI as soon as possible and at the latest within twoworking days if the Co-contractor receives a request from a data subject with a view to exercising his/her rights(such as the right of access, rectification, erasure or restriction of processing).
Taking into account the nature of the processing and the information available to the Co-contractor, the Cocontractor will reasonably assist ESI with appropriate technical and organizational measures, as far as possible, tofulfil ESI's obligation to respond to requests to exercise the data subject's rights.
ARTICLE 11 - REQUESTS FOR ACCESS FROM THIRD PARTIES
If the Co-contractor receives an order from a third party to disclose concerned personal data, the Co-contractor :1) will endeavor, as far as possible, to redirect the third party to request the data directly from ESI ;2) will promptly notify ESI, unless prohibited from doing so by applicable law, and, if prohibited from notifying
ESI, will use all lawful efforts to obtain the right to waive the prohibition in order to provide as muchinformation as possible to ESI in a timely manner;
3) use all legitimate and reasonable efforts to challenge the disclosure order on the basis of any legal
deficiencies under the laws of the requesting party or any relevant conflict with applicable law.
ARTICLE 12 - VIOLATION OF PERSONAL DATAThe Co-contractor will inform ESI without delay and at the latest within two working days of a breach of concerned
personal data. “Breach" means a breach of security resulting in the accidental or unlawful destruction, loss,alteration, unauthorized disclosure of or access to personal data transmitted, stored or otherwise processed.
The Co-contractor will reasonably assist ESI in complying with its obligations in relation to personal data breaches
in accordance with applicable data protection legislation and will take necessary and reasonable remedial action.
ARTICLE 13 - AUDITS
Subject to a right of control of public order being provided for by the law applicable to the protection of personaldata, ESI has the right to control, by appropriate means, the compliance of the Co-contractor and its SubsequentSub-contractor with the obligations regarding the protection of personal data. These audits are limited to theinformation and personal data processing systems that are relevant to the provision of the Services to ESI and arelimited to one audit per year.
In order to comply with ESI's imperative right of audit, the Co-contractor and its Subsequent Sub-contractor may
call upon auditors (internal or external) to carry out audits in order to verify compliance with the obligations
regarding the protection of personal data. Each audit gives rise to the drafting of an audit report ("Audit Report").
At ESI's request, the Co-contractor will provide the relevant Audit Reports for the Services concerned.
ESI accepts that these Audit Reports are used primarily to respond to the exercise of the Co-contractor's right toaudit as provided for in this article.
The Co-contractor will authorize additional audits to these Audit Reports, including on-site audits at the Cocontractor's facilities and premises by ESI or an independent and accredited third party, during normal businesshours, with reasonable notice from ESI (in excess of two working days).
The Audit Reports and any other information or documentation provided in the course of an audit constituteconfidential information and may only be provided to the Additional Auditors under confidentiality obligations
substantially equivalent to the confidentiality obligations contained in the Contract and the DPA.

DPA ESI (Controller) – Co-contractor (Processor) - Avril 2024 - Page 4 of 9

APPENDIX I - DESCRIPTION OF TREATMENT OPERATIONS(and, where applicable, Annex 1 of the SCC)
This Annex specifies the processing operations provided for in the DPA (including, but not limited to, the purposeof the processing, the nature and purpose of the processing, the type of personal data and the categories of data
subjects).
A.
LIST OF PARTIESESI (and, where the standard contractual clauses apply, the data exporter) :Name, address and name, position and contact details of the contact person: The name and address of ESI andthe contact details of a contact person are set out in the Contract.
The contact point for questions relating to data protection is the ESI GROUP Data Protection Officer:
dataprotection@esi-group.com
Role : ESI acts as controller for the processing activities provided by the Co-contractor to ESI and, whereapplicable, as processor under the instructions of its own data controllers.
The Co-contractor (and, where the standard contractual clauses apply, the data importer) :Name, address and name of contact person, function and contact details: The Co-contractor providing theprocessing services hereunder is the entity specified in the DPA.
The contact point for questions relating to data protection is the Data Protection Officer specified in the Contract
Role : The Co-contractor acts as a processor of personal data on behalf of ESI and, where applicable, ESI's otherdata controllers.
B.
DESCRIPTION OF TRANSFER/PROCESSING OPERATIONS
Categories of data subjects whose personal data are transferred/processed
The persons concerned specified in the Contract.
Categories of personal data transferred
The categories of personal data transferred/processed are specified in the Contract.
Sensitive data transferred (if applicable)
The Services are not intended for the processing of sensitive personal data.
The frequency of the transfer (for example, whether the data is transferred on a one-off or continuous basis)If the Service provided involves the provision of Services, the Co-contractor may only access personal data inconnection with the provision of the Service in question, unless otherwise specified in the Contract.
Nature of the processing and purpose(s) of the transfer and further processing of the data
Subject to prior, written and specific authorization, the Co-contractor and its Subsequent Sub-contractor will process
personal data for the proper performance of the Services provided for in the Contract.
How long the personal data will be kept or, if this is not possible, the criteria used to determine this period.
Personal data is kept for the duration of the Contract.
ESI may correct, delete or restrict the processing of personal data. The Co-contractor may also correct, delete orrestrict the processing of personal data in accordance with ESI's instructions.

DPA ESI (Controller) – Co-contractor (Processor) - Avril 2024 - Page 5 of 9

For transfers to Third-Party Processors, also specify the purpose, nature and duration of the processing.
The purpose, nature and duration of the treatment are specified in Annex III of the DPA.
C.
Where SCC applies : COMPETENT CONTROL AUTHORITY
Where the SCC applies, the supervisory authority responsible for ESI acts as the competent supervisory authority under
the SCC. A list of EU supervisory authorities is available at the following address:
https://ec.europa.eu/justice/article-29/structure/data-protection-authorities/index_en.htm

DPA ESI (Controller) – Co-contractor (Processor) - Avril 2024 - Page 6 of 9

ANNEX II - TECHNICAL AND ORGANISATIONAL MEASURES(and, where applicable, Annex 2 of the SCC)
This document describes the technical and organizational measures implemented by the Co-contractor toprotect the processing of personal data:
The following main technical and organizational measures are specified in the Contract.

DPA ESI (Controller) – Co-contractor (Processor) - Avril 2024 - Page 7 of 9

APPENDIX III - LIST OF APPROVED SUBSEQUENT SUB-CONTRACTOR(and, where applicable, Annex 3 of the SCC)No Subsequent Sub-Contractor is authorized as it stands.
Any request to use a Subsequent Sub-contractor must follow the provisions of the DPA.

DPA ESI (Controller) – Co-contractor (Processor) - Avril 2024 - Page 8 of 9

APPENDIX IV: NATIONAL LEGAL SPECIFICITIESUNITED KINGDOMFor transfers of personal data from the UK, the SCC will apply subject to the following changes:- the SCC are amended as specified in Part 2 of the International Data Transfer Rider to the European
Commission's standard contractual clauses issued under Section 119A of the UK Data Protection Act 2018,as it may be amended or replaced at any time (the "UK Rider") ;- the information set out in tables 1 to 3 of Part 1 of the UK Addendum corresponds respectively to that setout in the Addendum and the Contract (as the case may be); and- table 4 of part 1 of the UK Rider is completed by selecting "neither party".
UNITED STATES
If the Co-contractor processes personal data of US residents, it makes the following additional undertakings to ESI:
the Co-contractor will process the personal data on behalf of ESI and will not retain, use or disclose it for any
purposes other than those set out in the Contract and DPA as permitted by US data protection law.
These additional terms do not limit or reduce the Co-contractor's obligations to ESI with respect to the protectionof personal data under the DPA or the Contract entered into between ESI and the Co-contractor. The Co-contractor
hereby certifies that it understands the restrictions contained herein and that it will comply therewith.
BRAZIL
Each Party undertakes to :- comply with its obligations under the Brazilian General Data Protection Law, nº 13.709 de 2018 (Lei Geral deProteção de Dados Pessoais) ("LGPD") ;- keep a register of the personal data processing operations it carries out;
- appoint a Data Protection Officer; and- adopt security, technical and administrative measures to protect personal data against unauthorised accessand against accidental or unlawful destruction, loss, alteration, disclosure or any form of inappropriate orunlawful processing, including applicable minimum technical standards as defined by the nationalauthority.
To the extent that ESI transfers personal information from Brazil to the Co-contractor, established outside Brazil,
the Co-contractor will comply with the principles, data subject rights and data protection regime set out in the GDPR,
unless the Parties can rely on another mechanism or basis for transfer under data protection laws.

DPA ESI (Controller) – Co-contractor (Processor) - Avril 2024 - Page 9 of 9