EX-10.12



 Exhibit 10.12 

SERVICES AGREEMENT 
 This
Services Agreement (“Agreement”) is entered into as of July 1, 2017 (“Effective Date”) between Western Digital Technologies, Inc., a Delaware corporation, having a principal place of business at 5601
Great Oaks Parkway, San Jose, California 95138 and its Affiliates (collectively “WDT”), and One Stop Systems, Inc., a California corporation, having a place of business at 2235 Enterprise Street, Escondido, CA 92029
(“Consultant”). In consideration of the mutual covenants and conditions set forth below, the parties agree as follows: 

 

 1. SERVICES, STATEMENT OF WORKS, AND CHANGES TO SOW 

1.1 Services. Subject to the terms and conditions of this Agreement and at WDT’s request and direction,
Consultant will perform for WDT the services described in one or more Statements of Work or SOW (as defined below) (the “Services”) on a non-exclusive basis, without any minimum commitment
from WDT as to volume, scope or value. If any services, functions or responsibilities not specifically described in this Agreement or the applicable SOW are an inherent, necessary or customary part of the Services or are required for proper
performance or provision of the Services in accordance with this Agreement or such SOW, they shall be deemed to be included within the scope of the Services to be delivered for the agreed upon fees, as if such services, functions or responsibilities
were specifically described in this Agreement or the applicable SOW. 
 1.2 Statement of Work. The specific details
of the Services to be performed will be determined on a per-project basis, and the details for each project will be described in a written SOW, substantially in the form of the SOW set forth in Exhibit
A, that is executed by both parties (each, a “Statement of Work” or “SOW”). Once executed by both parties, each SOW will be a unique agreement that incorporates the terms of this Agreement and stands alone
with respect to all other Statements of Work. If there is a conflict between the terms of this Agreement and the terms of a SOW, the terms of this Agreement will control unless the SOW states that a specific provision of this Agreement will be
superseded by a specific provision of the SOW. 
 1.3 Changes to SOW. WDT may request reasonable changes to the SOW
prior to completion. No such proposed changes, including without limitation any associated changes in the price, payment schedules, and projected completion dates, shall be effective unless accepted in writing by authorized representatives of both
the parties. WDT may reasonably request in writing that revisions be made with respect to the Services or deliverables set




 
forth in a SOW (each, a “Change Order”). If a Change Order recites revisions that materially increase the scope of the Services or the effort required to deliver deliverables
under the applicable SOW, then within 5 business days after Consultant’s receipt of such Change Order, Consultant will deliver to WDT a written, revised SOW reflecting Consultant’s reasonable determination of the revised Services,
deliverables, delivery schedule, and payment schedule, if any, that will apply to the implementation of the revisions. If WDT approves the revised SOW, then the parties will execute it, and upon execution, the revised SOW will supersede the
then-existing SOW. If WDT does not approve the revised SOW within five (5) business days after its receipt, the then-existing SOW will remain in full force and effect, and Consultant will have no further obligation with respect to the
applicable Change Order. 
 2. PERFORMANCE OF SERVICES 

2.1 Performance Standard. Consultant will diligently perform the Services in accordance with the applicable SOW,
including any specifications in the SOW. Consultant will use its best efforts to complete the Services, including the delivery of any Work Products (as defined below), in accordance with the schedule of times and milestones specified in the SOW.

 2.2 Subcontractors. Consultant shall not utilize subcontractors or third parties (each a “Third
Party” or collectively, “Third Parties”) to perform material parts aspects of the Services without WDTs prior written approval. If Consultant uses Third Parties in performance of the Services, the obligations in this
Agreement (and any applicable SOW) shall apply equally to Consultant and Third Parties. Consultant shall inform such Third Parties of the obligations hereunder and ensure that such Third Parties cooperate and fully comply with the requirements of
this Agreement and applicable SOW. Consultant shall be fully responsible and liable to WDT for all acts and omissions of Third Parties as if Consultant had performed the work of such Third Parties, and Consultant shall indemnify and hold


 


  
 Page 1 of 11 









 
WDT harmless from any breach of these obligations by the Third Parties. WDT, in its sole discretion, may restrict Consultant from using a Third Party or require that a Third Party be removed from
the performance of Services, for any or no reason. 
 2.3 Compliance with WDT Policies. If Services are to be
performed at a WDT site or using WDT systems, Consultant’s employees, agents, subcontractors, and Third Parties shall comply at all times with WDT’s health, safety, security, and electronic media policies and procedures, including
WDT’s Worldwide Code of Business Conduct and Ethics Policy and WDT Supplier Code of Ethical Conduct available at http://www.sandisk.com. 

2.4 Compliance with Data Usage and Protection. Consultant represents and warrants that Consultant’s Personnel
will comply with the Data Usage and Protection Exhibit attached as Exhibit B. The purpose of Exhibit B is to establish requirements for Consultant for the collection, use, retention, and disclosure of Personal Data (as defined in Exhibit B) related
to WDT, WDTs customers, prospective customers, online visitors and business partners. Personal Data may not be added to any database unless it is collected in accordance with Exhibit B and with WDT’s prior written consent. 

2.5 Materials. Except as otherwise specified in a SOW, Consultant will be responsible for and supply all necessary
equipment, materials, and other resources required to perform the Services. 
 2.6 WDT Materials. Except for certain
tools transferred to Consultant under the License Agreement, Any materials provided by WDT to Consultant are to be used solely to perform the Services. WDT will own these materials as well as any derivatives or improvements of these materials
developed or derived by Consultant (“WDT Materials”). Consultant will treat the WDT Materials as WDTs Confidential Information (as defined in Section 4 of the License Agreement and Section 7 of this Agreement).
Except for normal wear and tear associated with permitted use of the WDT Materials, Consultant will assume all risk of loss, damage, theft, or destruction of the WDT Materials while they are in Consultant’s possession or control or that of
Consultant’s agents, and will reimburse WDT for any such costs of repair or replacement. Consultant will keep the WDT Materials free of all security interests, liens, and other encumbrances.



 2.7 Audits. WDT may visit Consultant’s facilities, and Consultant
shall ensure WDT has the right to visit Third Parties’ facilities, at reasonable times and with reasonable frequency during normal business hours to observe the performance of the Services and Consultant shall provide WDT access to
Consultant’s records and other pertinent information, all to the extent relevant to the Services and Consultant’s obligations under this Agreement. 

3. RESERVED 
 4. RESERVED 

5. COMPENSATION 
 5.1
Fees. The fees to be paid by WDT to Consultant in consideration for the services and deliverables rendered pursuant to this Agreement will be set out in the applicable SOW. 

5.2 Invoices. Invoices referencing the applicable WDT purchase order and SOW must be submitted to Western Digital
Technologies, Inc., 951 SanDisk Drive, Milpitas, CA 95035-7933, ATTN: ACCOUNTS PAYABLE, with a copy to the WDT manager as identified in the applicable SOW. Payment by WDT will be issued within sixty (60) days from WDT’s receipt of an
undisputed invoice; provided, that (i) if any such invoices are due by the 5th of the month, such invoice shall be paid by the end of the first fiscal week of that month and (ii) if any such invoice is due after the 5th of the month, such
invoice shall be paid by the end of the first fiscal week of the following month. Charges for freight expenses must be pre-approved by WDT in writing and billed at actual cost, and invoices containing such
charges shall be accompanied by receipts and supporting documentation. WDT shall not be liable for any travel expenses unless such expenses are pre-approved in writing by WDT and incurred in accordance with
WDT’s consultant travel policy (which will be provided upon request). WDT shall not be obligated to pay any invoice from Consultant or on Consultant’s behalf more than ninety (90) days after WDT has accepted the applicable Work
Product. WDT is entitled to apply any credit or excess payment against other payments or obligations to Consultant. 

5.3 Taxes and Withholdings. WDT shall pay all taxes relating to the Work Products, except franchise taxes or taxes
based upon the income of Consultant. Consultant acknowledges and agrees that WDT has the right to withhold any applicable taxes from any payments due under this Agreement if required under the applicable law or by any government agency. All prices
stated in an SOW 

 


  
 Page 2 of 11 









 
under this Agreement is hereby deemed to include all applicable taxes, duties, tariffs and similar liabilities whatsoever for delivery of all Work Products to WDT. Consultant is solely
responsible for all wages and other compensation, and for all federal, state, local, FICA and other similar withholding and payments required in connection with Consultant or Consultant’s employees, associates, contractors, agents, affiliates
and other representatives (“Consultant’s Personnel”). 
 6. TERM AND TERMINATION 

6.1 Term. This Agreement commences on the Effective Date and continues unless terminated in accordance with the terms
of this Section 6. 
 6.2 Termination by Either Party. Either party may terminate this Agreement and/or any SOW
by written notice (a) if the other party fails to cure any material breach within thirty (30) days of receipt of written notice of such breach; (b) if the other party becomes involved in any voluntary or involuntary bankruptcy
proceeding or any other proceeding concerning insolvency, dissolution, cessation of operations, reorganization or indebtedness or the like and the proceeding is not dismissed within sixty (60) days; or (c) if the other party becomes
insolvent or unable to pay its debts as they mature in the ordinary course of business or makes an assignment for the benefit of its creditors. 

6.3 Termination by WDT. This Agreement and/or any SOW may be terminated in whole or in part, by WDT, at any time for
convenience upon WDT giving at least five (5) days prior written termination notice to Consultant. In such an event, WDT shall pay to Consultant termination charges computed in the following manner for completed work: (1) undisputed
invoiced amounts received by WDT but not yet paid; and (2) reimbursement of preapproved actual and reasonable costs incurred by Consultant prior to the date of termination; provided, however, Consultant shall endeavor to mitigate costs after
receiving such termination notice from WDT. WDT shall not be liable to Consultant for any costs which would not have been charged had this Agreement not been terminated nor for any sum in excess of the total price stated in this Agreement for the
terminated Services. In the event of any cancellation or termination of this Agreement and/or any SOW, Consultant will return all prepaid fees and credits in excess of the amounts due to Consultant under this Section 6.3. Consultant will return
all such prepaid fees and credits within thirty (30) days of the termination effective date.



 6.4 Survival. Upon termination, all rights and duties of the parties
toward each other cease except that: 
 (a) Within 5 business days of the effective date of termination, Consultant will
return to WDT any amount paid to Consultant as a retainer or prepayment that is not owed against Services; and 
 (b)
Sections 2.2, 2.4, 2.6, 6.3, 6.4, 6.5, 7, 10, 11, 12, 13, and any other section, by its nature should survive, will survive termination or expiration of this Agreement. 

6.5 Return of Materials. Upon the termination of this Agreement, or upon WDT’s earlier request, Consultant will
deliver to WDT all WDT Materials (as defined in Section 2.6) and Confidential Information (in accordance with Section 7) that are in Consultant’s possession or control. 

7. CONFIDENTIALITY. Section 4 of the License Agreement is incorporated herein by reference. In addition, the term
“Confidential Information,” as used therein, includes information exchanged between the parties that relates to the Services. 
 8. RESERVED

 9. CONSULTANT’S WARRANTIES 

Consultant represents, warrants and covenants as follows: 

9.1 Organization Representations; Enforceability. 

Consultant is duly organized, validly existing, and in good standing. The execution and delivery of this Agreement by Consultant and the
transactions contemplated hereby have been duly and validly authorized by all necessary action on the part of Consultant. This Agreement constitutes a valid and binding obligation of Consultant that is enforceable in accordance with its terms. 

9.2 No Conflict. The entering into and performance of this Agreement and all SOWs by Consultant does not and will not
violate, conflict with, or result in a material default under any other contract, agreement, indenture, decree, judgment, undertaking, conveyance, lien, or encumbrance to which Consultant is a party or by which it or any of Consultant’s
property is or may become subject or bound. Consultant will not grant any rights under any future agreement, nor will it permit any lien, obligation, or encumbrances that will conflict with the full enjoyment by WDT of its rights under this
Agreement. 

 


  
 Page 3 of 11 









 9.3 Applicable Law. Consultant will perform all of its obligations
hereunder in compliance with all applicable laws, rules, and regulations. 
 9.4 No Open Source. Any computer
program provided as part of an Invention or a Work Product will not contain any software code that is subject to a license requiring, as a condition of use, modification, or distribution of the software code, that the software code or other software
code combined or distributed with it be (a) disclosed or distributed in source code form; (b) licensed for the purpose of making derivative works; or (c) redistributable at no charge. 

9.5 Services. The Services will be performed in a timely, competent, professional, and workmanlike manner by qualified
personnel. For any defective or non-conforming services or deliverables, Consultant’s obligation hereunder shall be promptly to: (i) bring such service or deliverable into compliance with such
requirements, at Consultant’s expense, or at WDTs election, (ii) grant WDT a full refund of the compensation paid by WDT relating to the defective services and/or deliverables. 

10. INDEMNIFICATION 

10.1 Indemnification. Consultant shall indemnify, defend and hold harmless WDT and its officers, directors, employees,
shareholders, customers, agents, successors and assigns (“WDT Indemnified Parties”) from and against any and all claims, losses, damages, costs, expenses (including reasonable legal expenses) and settlements that Consultant might
agree to resulting from or arising out of (i) the wrongful acts or omissions of Consultant or Consultant’s Personnel; (ii) employment claims; (iii) Consultant’s failure to comply with applicable laws, rules and regulations;
(iv) Consultant’s breach of its obligations with respect to WDT Confidential Information; and (v) claims of Intellectual Property Right infringement which alleges that any Work Product or any component thereof infringes upon,
misappropriates, or violates any Intellectual Property Rights of a Third Party (each “Indemnified Claim”). 

10.2 Settlement. Consultant shall not settle any Indemnified Claim without the written consent of WDT unless the
compromise or settlement unconditionally includes the claimant’s or the plaintiffs release of the WDT Indemnified Parties from all liability and the settlement does not impose any affirmative obligation on the WDT Indemnified Parties.



 10.3 Remedies. In the event of an Indemnified Claim, Consultant will,
in addition to its other obligations set forth in this Section 10, at its expense, at WDT’s option: (i) obtain and confirm to WDT, all rights required to permit the continued sale or use of the Work Product by WDT under this
Agreement; (ii) modify or replace such Work Product to make them non-infringing (and extend this indemnity thereto) while still conforming to this Agreement, provided that any such replaced or modified
Work Product are satisfactory to WDT; or (iii) at WDT’s request, promptly refund to WDT the fees, plus all shipping, storage and associated costs of any Work Product returned. 

11. Limitation of Liability. 

11.1 EXCEPT FOR (A) BREACH OF 

CONFIDENTIALITY OBLIGATIONS, (B) 

CONSULTANT’S INDEMNIFICATION OBLIGATIONS, AND (C) CONSULTANT’S WILLFUL MISCONDUCT OR GROSS NEGLIGENCE, NEITHER PARTY WILL BE
LIABLE FOR INDIRECT, PUNITIVE, SPECIAL, INCIDENTAL, EXEMPLARY OR CONSEQUENTIAL DAMAGES IN CONNECTION WITH OR ARISING OUT OF THIS AGREEMENT, HOWEVER IT ARISES, WHETHER FOR BREACH OR IN TORT, INCLUDING BUT NOT LIMITED TO LOSS OF PROFITS, DATA OR
BUSINESS INTERRUPTION, EVEN IF THAT PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 11.2 IN NO EVENT
SHALL WDT’S TOTAL CUMULATIVE LIABILITY ARISING UNDER THIS AGREEMENT, WHETHER SUCH THEORY OF LIABILITY IS BASED IN CONTRACT, TORT OR OTHERWISE, EXCEED THE TOTAL AMOUNT OF THE PAYMENTS ACTUALLY PAID AND PAYABLE BY WDT UNDER THE AGREEMENT IN THE
PRECEDING TWELVE (12) MONTHS PRIOR TO THE DATE THE LIABILITY FIRST AROSE. 
 12. INSURANCE 

Consultant agrees to comply with WDT’s insurance requirements included in the attached Exhibit C. 

13. MISCELLANEOUS 

13.1 Services and Information Prior to Effective Date. All services performed by Consultant and all information and
other materials disclosed between the parties prior to the Effective Date will be governed by the terms of this Agreement, except where the services are covered by a separate agreement between Consultant and WDT.


 


  
 Page 4 of 11 









 13.2 Foreign Corrupt Practices Act. Neither Consultant nor any of
Consultant’s directors, officers, agents, employees, affiliates or other person associated with or acting on behalf of Consultant or any of its subsidiaries has (i) used any funds for any unlawful contribution, gift, entertainment or other
unlawful expense relating to political activity or to influence official action; (ii) made any direct or indirect unlawful payment to any foreign or domestic government official or employee; (iii) made any bribe, rebate, payoff, influence
payment, kickback or other unlawful payment; or (iv) violated, or is in violation of, any provision of the U.S. Foreign Corrupt Practices Act of 1977, as amended, the UK Bribery Act 2010, as may be amended, and any other anti-corruption/bribery
laws and regulations (“Anti-Corruption Laws”) applicable to Consultant the Services provided under this Agreement. Consultant, Consultant’s directors, officers, agents, employees, affiliates and any other person associated with or
acting on behalf of Consultant or any of its subsidiaries represent and warrant that they have conducted their businesses in compliance with the Anti-Corruption Laws, and have instituted and maintain policies and procedures designed to ensure, and
which are reasonably expected to continue to ensure, compliance therewith. 
 13.3 The parties acknowledge and agree
that a violation of Section 7 (Confidentiality) may cause immediate and irreparable harm to the other party for which money damages may not constitute an adequate remedy at law. Therefore, the parties agree that the disclosing party shall be
entitled to seek appropriate equitable relief in addition to whatever remedies it might have at law, including, without limitation, attorney’s fees, in connection with any breach or enforcement of the obligations hereunder or the unauthorized
use or release of any such Confidential Information. 
 13.4 Sections 11.1 through 11.10 of the License Agreement
are incorporated herein by reference. 


 14. DEFINITIONS 

14.1 “Affiliate” means any entity that Controls, is Controlled by, or is under common Control with another
person or entity. 
 14.2 “Control” means more than 50% of the ownership of voting shares, by contract or
otherwise; but in any such case: (i) such entity shall be deemed to be an Affiliate only so long as such Control exists, and (ii) such entities that would be considered to be under Control solely as a result of being controlled by a
government of any sovereign country are hereby excluded. 
 14.3 “Intellectual Property Rights” means the
collective, worldwide intellectual property and proprietary rights of a party now held or hereafter filed, issued, created or acquired, under statutory or common law in any jurisdiction, including under patent, copyright, trademark, and trade secret
law, or acquired by contract, and any and all other proprietary rights whether or not protectable by statutory or common law, including for and in (i) all classes or types of patents and patent applications; (ii) all works of authorship,
including all copyrights and moral rights in both published and unpublished works and all registrations and applications; (iii) all mask works and all registrations and applications; and (iv) all discoveries, inventions, ideas, and designs
(whether patentable or not), know-how, developments, improvements, trade secrets, and confidential and proprietary technical and non-technical information. 

14.4 “License Agreement” means the Technology and Source Code License Agreement between the parties dated
the same date as this Agreement. 
 14.5 “Work Product” shall mean all Services and deliverables to be
provided by Consultant as set forth in this Agreement on a non-exclusive basis and as specified in the attached SOWs. 

 


  
 Page 5 of 11 








 Agreed to and accepted by the undersigned authorized representatives as of the Effective Date:

  

									
	WESTERN DIGITAL TECHNOLOGIES, INC.	  		  	ONE STOP SYSTEMS, INC.
					
	 Sign:
	  	 /s/ Philip Bullinger
	  		  	 Sign:
	  	 /s/ Steve Cooper

	 Print:
	  	 Philip Bullinger
	  		  	 Print:
	  	 Steve Cooper

	 Title:
	  	 SVP and GM, Data Center Systems
	  		  	 Title:
	  	 President & CEO



  
 Page 6 of 11 








 Exhibit A 

Statement of Work 
 This Statement of Work
(“SOW”) between WDT and Consultant is governed by and subject to the terms and conditions of the Services Agreement dated the same date as this SOW between WDT and Consultant. Undefined capitalized terms used herein are defined in the
Agreement. 
 1. DESCRIPTION OF SERVICES; SERVICE FEES 

a. Description 
  

			
	 Description of the Services
	  	 Service Fees

	 See Section 3.3 and Attachments 2 and 3 of the License Agreement
	  	 See Section 5.1 of the License Agreement.


 b. Delay 

WDT reserves the right, in its sole discretion, to suspend or delay the performance of the Services. If WDT elects to exercise
such right and WDT’s decision is based, at least in material part, on Consultant’s failure to perform its obligations under the SOW, WDT shall not incur any charges or reimbursable costs in connection with such decision. If WDT’s
decision is not based in material part on Consultant’s failure to perform its obligations under the SOW, WDT shall reimburse Consultant for any additional costs reasonably incurred by Consultant as a result of such decision (provided that
Consultant notifies WDT in advance of such costs, obtains WDT’s approval prior to incurring such costs, and uses commercially reasonable efforts to minimize such costs) 

2. TERM 
 From the
Effective Date through February 28, 2022. 
 3. PAYMENT SCHEDULE; PAYMENT TERMS 

See sections 5.1 and 5.6 of the License Agreement. 

  
 Page 7 of 11 








 Exhibit B 

Data Usage and Protection Exhibit (“Exhibit”) 

 

 1. SCOPE. Consultant and WDT agree to the terms in this Exhibit regarding the Processing
of WDT Data. To the extent that Consultant Processes WDT Data, it will do so as a processor acting on behalf of WDT (as controller) and according to the terms in the Agreement and this Exhibit. Subject to such terms, WDT grants to Consultant a
non-exclusive limited license to use WDT Data solely for the purpose identified in the Agreement. In the event of conflict between the terms of this Exhibit and the Agreement relating to data use and protection, the terms of this Exhibit will
prevail. 
 2. DEFINITIONS. The terms “controller” and “processor” shall have the meanings given in
the Directives. 
 2.1. “Consultant” shall have the meaning given in the Agreement. 

2.2. “Data Breach” means any accidental or unlawful destruction or accidental loss, alteration, unauthorized
disclosure or access or other unlawful forms of processing 
 2.3. “Data Protection Laws” means data
protection and privacy laws of each country where: (a) a WDT entity responsible for WDT Data is established; and (b) WDT Data is processed, including, without limitation the European Data Protection Directive (95/46/EC) and the Privacy and
Electronic Communications Directive (2002/58/EC) (collectively, the “Directives”) in the European Economic Area (“EEA”) including any laws which amend, replace and/or supersede the Directives, and in the United
States, the Federal Trade Commission Act, the Health Insurance Portability and Accountability Act, the Children’s Online Privacy Protection Act, and any applicable rules issued by a competent data protection authority or governmental body. 

2.4. “Opt-in” means an Owner expressly consents to certain uses of
his/her Personal Data by taking affirmative action to indicate consent, such as in writing, by checking the appropriate option or box, by affirmative statement, or otherwise at the time of collection. 

2.5. “Owner” means any person or data subject about whom Personal Data is Processed.



 2.6. “Personal Data” means information on its own or when
combined with other data, to enable identification, directly or indirectly, of a person, including but not limited to, email or physical address, name, title, phone number, employer, birth date, gender or other unique identifiers. Personal Data
includes Sensitive Personal Data. 
 2.7. “Processing” (or verb variation thereof) means taking any
action, actively or passively, in connection with WDT Data, including, but not limited to: collecting; receiving; using; transferring; disclosing; disseminating; making available; recording; organizing; storing; retaining; altering; accessing;
processing; retrieving; consulting on; aligning; combining; blocking; making anonymous; erasing; disposing of; or destroying Personal Data. 

2.8. “WDT” shall have the meaning given in the Agreement. 

2.9. “WDT Data” means any and all data, information and content (including Personal Data) and whether
confidential or not which is made available to or Processed by Consultant on WDT’s behalf. 
 2.10. “Sensitive
Personal Data” means Personal Data identifying race or ethnic origin; religious or philosophical beliefs; political opinions; party membership; criminal records; geo-location data; financial data;
health data; sexual behaviors; or other Personal Data which may subject the Owner to embarrassment or harm if disclosed. 
 3. COMPLIANCE AND
COOPERATION. Consultant represents and warrants it will comply with Data Protection Laws in Processing of WDT Data. If the Data Protection Laws impose stricter obligations on Consultant than this Exhibit, the Data Protection Laws shall prevail.
Consultant shall provide all cooperation to WDT regarding Processing of WDT Data to enable WDT to comply with any Data Protection Laws. Consultant shall nominate a representative within its organization to promptly and fully respond to WDTs queries
regarding Processing of WDT Data. 
 4. SECURITY AND MANAGEMENT OF WDT DATA. Consultant undertakes, represents and warrants:


 


  
 Page 8 of 11 









 4.1. to Process WDT Data only as instructed by WDT, as necessary to
fulfill its contractual obligations to WDT and not for its own purposes; 
 4.2. that access to WDT Data will be
limited to those with a legitimate need to know; 
 4.3. to process WDT Data only for the purpose of providing the
tasks and/or services under the Agreement and in accordance with WDT’s lawful instructions; 
 4.4. to not
divulge the whole or any part of WDT Data to any person, except to the extent necessary for the performance of the Agreement and this Exhibit or otherwise in accordance with WDT’s lawful instructions; 

4.5. to not do anything relating to WDT Data which may result in WDT’s breach of Data Protection Laws; 

4.6. that it has in place current disaster recovery plans in relation to any systems which Process the WDT Data; 

4.7. to maintain appropriate technical and organisational security measures to protect WDT Data; 

4.8. to immediately notify WDT of any Data Breach and to perform acts in order to remedy or mitigate the effects of
the Data Breach and to continuously update WDT of developments. In the event that any WDT Data is lost, damaged or destroyed, Consultant shall promptly restore such WDT Data to the last available backup; 

4.9. to promptly notify WDT of all data protection related inquires (including inquiries from any regulator, law
enforcement or government agency) or complaints related to WDT Data; 
 4.10. to provide all assistance reasonably
required to enable WDT to respond to or resolve any request, question or complaint received by WDT from any Owner whose Data is processed by Consultant on behalf of WDT; or any regulator, law enforcement or government agency; 

4.11. to not disclose WDT Data or Processing details unless at the written instruction of WDT or unless legally
compelled, provided that Consultant immediately notify WDT so WDT may seek a protective order; 
 4.12. to promptly
carry out requests from WDT to amend, transfer or destroy the WDT Data; and 
 4.13. to bear the costs of complying
with applicable requirements arising under Data Protection Laws.



 4.14. Consultant represents and warrants that when acting on WDT’s
behalf: 
 a) Personal Data will not be collected (including by cookies or other technologies) without providing the Owner
with fair, lawful and sufficient notice pursuant to applicable Data Protection Laws. 
 b) Personal Data will be collected
on behalf of WDT solely when the Privacy Statement (located at https://www.wdc.com/about-wd/legal/privacy- policy.html) is clearly available to Owners prior to collection: (a) if online, the Privacy
Statement must be linked immediately adjacent to the “submit” (or similar) button and the consent of the Owner must be obtained (e.g., a box which the Owner may choose to check, stating “I understand and agree that my personal
information will be used as outlined in the Privacy Statement”); or (b) if by phone, by providing a short and relevant collection notice with direction to the URL of the Privacy Statement for further information; or (c) for all other
collections, the Privacy Statement will be made available. 
 c) Personal Data of a child under age 13 will not be
collected. 
 d) Personal Data collected for marketing or specific targeting purposes may only be Processed for the
specific purpose(s) for which the Owner either consented or for which the Owner was provided with adequate notice. 
 e)
Any commercial emails sent by the Consultant will include a functional unsubscribe option. 
 f) Opt-ins obtained by the Consultant for text messaging must be by a written (such as electronic format), auditable consent by Owner; and text messages sent by Consultant acting on behalf of WDT to a mobile device
must comply with the Global Code of Conduct of the Mobile Marketing Association (“MMA”) and any MMA region-based guide (for example, in the U.S., the U.S. Consumer Best Practices for Messaging) or any comparable and applicable in
country guidance or best practice. 
 5. TRANSFER. Consultant represents and warrants not to Process, nor to permit any Sub-Processor
(defined below) to Process, WDT Data outside of the jurisdiction in which WDT Data is made available to Consultant (a “Transfer”) except following WDT’s written consent and Consultant’s continued compliance with the terms
of this Exhibit. 

 


  
 Page 9 of 11 








 
 6. SUB-PROCESSORS. Consultant shall not delegate
or subcontract any Processing to another party (“Sub-Processor”) without WDT’s prior written consent provided at WDT’s sole discretion. Consultant shall provide WDT with the identity
and role of the proposed Sub-Processor, details relating to security, the location of any data facilities and Processing activities and other data WDT may reasonably request. Consultant shall enter into an
agreement with Sub-Processor containing equivalent terms to this Exhibit (provided that Sub-Processor not subcontract or delegate duties without WDT’s consent) which provides WDT with third party
beneficiary rights sufficient to enforce any such agreement; or require Consultant to require the Sub-Processor to enter into direct terms with WDT. 

7. INDEMNIFICATION. Consultant shall be responsible for all acts and omissions relating to Processing of WDT Data, including the acts or
omissions of its personnel, agents and Sub-Processors (each a “Representative”). Consultant agrees to indemnify, hold harmless and, upon WDT’s request, defend WDT and its directors,
officers, employees, shareholders and agents from and against any and all damages, liabilities, costs, expenses, claims, fines and losses brought by a third party, including reasonable attorneys’ fees, in connection with, in whole or in part,
Consultant’s and/or any Representative’s breach of this Exhibit. 
 8. AUDIT, INFRASTRUCTURE AND NOTICES. 

8.1. Audit. Consultant consents that WDT and its authorized representatives may inspect and audit Processing of WDT Data on
Consultant




 
systems and at its facilities and by electronic monitoring without further notice. If an audit finds non-compliance with this Exhibit, Consultant shall
take all reasonable steps to promptly remedy any breach, or provide a detailed report as to why such breach cannot be remedied and pay WDT’s reasonable audit costs. 

8.2. Infrastructure Changes. Consultant shall notify WDT of any planned changes to its infrastructure or
processes involving WDT Data prior to any change. If WDT believes such change may compromise WDT Data or lead to the breach of any applicable Data Protection Laws, Consultant agrees to modify or delay such changes until WDT’s reasonable
concerns are resolved. WDT will have the right to terminate or suspend Processing by Consultant in whole or part without any liability to Consultant until WDT’s issues are resolved. 

9. RETURN OF DATA. Upon written request or termination or expiration of this Exhibit, Consultant shall: (i) immediately cease
Processing the WDT Data; and (ii) return to WDT in WDT’s preferred format, or at WDT’s option destroy or expunge the WDT Data and all copies or extracts within five days in accordance with the Guidelines for Media Sanitation
(Publication 800-88) from the National Institute of Standards and Technology. Upon request, Consultant shall certify in writing its compliance with these obligations. 

END OF EXHIBIT 

 


  
 Page 10 of 11 








 Exhibit C 

Insurance 
  

	1.	 During the performance of services and for one (1) year after termination of this Agreement, Consultant
at its sole cost and expense will carry and maintain the following minimum insurance coverage from insurance carriers with an A.M. Best rating of A- VII or better: 



 

	 	1.1.	 Commercial general (or public) liability, including products/completed operations and personal injury
coverage, with limits of not less than $1,000,000 combined single limit per occurrence and $2,000,000 annual aggregate; 


  

	 	1.2.	 Automobile liability with limits of not less than $1,000,000 each accident, bodily injury and property damage
combined; 


  

	 	1.3.	 Umbrella/excess liability, including products/completed operations, with limits of not less than $1,000,000
each occurrence; 


  

	 	1.4.	 Workers’ compensation insurance, or similar insurance according to applicable legal requirements, in
compliance with all statutory regulations in any state or country where any of the products and/or services are manufactured or delivered, and employer’s liability limits of $1,000,000; 



 

	2.	 Consultant’s insurance coverage shall be primary, and any insurance coverage of WDT’s will be excess
and non-contributory, with regards to any loss applicable under Consultant’s insurance coverage. 


  

	3.	 Consultant’s commercial general liability, umbrella, and automobile liability insurances shall name
Western Digital Corporation, WDT, its directors, officers, employees, subsidiaries, agents, and any other party which WDT may reasonably designate, as an additional insured. 



 

	4.	 Consultant will provide a thirty (30) day notice period for cancellation,
non-renewal or reduction in coverage or limits, in writing, to WDT. 


  

	5.	 Consultant’s insurance policies shall waive subrogation against WDT, its officers, directors, employees
and shareholders in the event of any loss suffered. 


  

	6.	 Consultant will, upon WDT request, deliver to WDT one or more certificates of insurance showing evidence of
the coverage required above upon award of contract, before commencement of work. 


  

	7.	 Consultant’s policies shall not have a retention or deductible of over $1,000,000. Any and all
deductibles or self-insured retentions must be declared to WDT and assumed by and for the account of, and the sole risk of, the Consultant. 


  

	8.	 Certificates of Insurance to be mailed to: 



Western Digital Corporation 

Attn: Risk Management Department 

3355 Michelson Dr., Suite 100 

Irvine, CA 92612 

  
 Page 11 of 11