Document:

Exhibit

Exhibit  10.2

PARK NATIONAL CORPORATION 
2017 LONG-TERM INCENTIVE PLAN FOR NON-EMPLOYEE DIRECTORS
The purpose of this Plan is to foster and promote the long-term financial success of the Company and the Affiliates and to increase shareholder value by motivating the performance of Directors through incentive compensation.  This Plan also is intended to encourage Participants to acquire and maintain an ownership interest in the Company, enable the Company and the Affiliates to attract and retain talented directors and affiliate/advisory board members, and allow Participants to participate in the Company’s long-term growth and financial success.  
This Plan, together with the Park National Corporation 2017 Long-Term Incentive Plan for Employees, are intended to replace, in its entirety, the Park National Corporation 2013 Long-Term Incentive Plan.  Upon approval of this Plan by the Company’s shareholders, the right of the Company to make additional grants under the Park National Corporation 2013 Long-Term Incentive Plan to Directors will be immediately terminated.
ARTICLE I 
DEFINITIONS
When used in this Plan, the following capitalized words, terms and phrases shall have the meanings set forth in this Article I.  For purposes of this Plan, the form of any word, term or phrase shall include any and all of its other forms.
1.1“Act” means the Securities Exchange Act of 1934, as amended from time to time, or any successor thereto.
1.2“Affiliate” means any entity with whom the Company would be considered a single employer under Section 414(b) or Section 414(c) of the Code, but modified as permitted under Treasury Regulations promulgated under any Code section relevant to the purpose for which the definition is applied and including any “parent corporation” or “subsidiary corporation” as defined under Section 424(e) and Section 424(f) of the Code.
1.3“Award” means any Nonqualified Stock Option, Stock Appreciation Right, Restricted Stock, Restricted Stock Unit, Other Stock-Based Award or Cash-Based Award granted pursuant to this Plan. 
1.4“Award Agreement” means any written or electronic agreement between the Company or any Affiliate and a Participant that describes the terms and conditions of an Award.  If there is a conflict between the terms of this Plan and the terms of an Award Agreement, the terms of this Plan shall govern.
1.5“Board” means the Board of Directors of the Company.
1.6“Cash-Based Award” means a cash Award granted pursuant to Article X of this Plan.
1.7“Cause” means, unless otherwise provided in the related Award Agreement or in any other agreement between the Participant and the Company or any Affiliate (but only within the context of the events contemplated by the other agreement, as applicable), a Participant’s: (a) willful and continued failure to substantially perform assigned duties; (b) gross misconduct; (c) breach of any written covenant or of any term of any agreement with the Company or any Affiliate, including this Plan and any Award Agreement; (d) commission of a felony or of a gross misdemeanor involving moral turpitude in connection with the Participant’s service with the Company or any Affiliate, or commission of a crime other than a felony which involves a breach of trust or fiduciary duty, in each case whether or not involving the Company or any Affiliate; (e) fraud, disloyalty, dishonesty or willful violation of any law, rule or regulation or of the Company’s Code of Business Conduct or any other policy of the Company or any Affiliate that applies to the Participant; or (f) issuance of an order for removal of the Participant by any agency which regulates the activities of the Company or any Affiliate.  

1.8“Change in Control” means, unless otherwise provided in any agreement between the Participant and the Company or any Affiliate (but only within the context of the events contemplated by the agreement, as applicable), the occurrence of any of the following:
		
	(a)
	the members of the Board on the effective date of this Plan (the “Incumbent Directors”) cease for any reason other than death to constitute at least a majority of the members of the Board; provided, however, that any individual becoming a director of the Company after the effective date of this Plan whose election, or nomination for election by the Company’s shareholders, was approved by a vote of at least a majority of the then Incumbent Directors shall also be treated as an Incumbent Director, but excluding any individual whose initial assumption of office occurs as a result of a proxy contest or any agreement arising out of an actual or threatened proxy contest;

		
	(b)
	the acquisition by any person or group (within the meaning of Section 13(d) and Section 14(d)(2) of the Act), other than the Company, any Affiliate or any employee benefit plan (or related trust) sponsored or maintained by the Company or any Affiliate, of beneficial ownership (within the meaning of Rule 13d-3 promulgated under the Act), directly or indirectly, of 25% or more of the combined voting power of the then outstanding voting securities of the Company entitled to vote generally in the election of directors of the Company; provided, however, that the provisions of this Section 1.8(b) shall not include the acquisition of voting securities by any entity or person with respect to which the acquirer has filed SEC Schedule 13G (or any successor form or filing) indicating that the voting securities were not acquired and are not held for the purpose of or with the effect of changing or influencing, directly or indirectly, the Company’s management or policies, unless and until that entity or person indicates that its intent has changed by filing SEC Schedule 13D (or any successor form or filing);

		
	(c)
	the consummation of a merger, consolidation or other business combination of the Company with or into another entity, or the acquisition by the Company of assets, shares or equity interests of another entity, as a result of which the shareholders of the Company immediately prior to such merger, consolidation, other business combination or acquisition do not immediately thereafter beneficially own, directly or indirectly, more than fifty percent (50%) of the combined voting power of the then outstanding voting securities entitled to vote generally in the election of directors of the entity resulting from such merger, consolidation or other business combination of the Company;

		
	(d)
	the sale or other disposition of all or substantially all of the assets of the Company;

		
	(e)
	the sale or other disposition of all or substantially all of the assets of The Park National Bank or the change in the ownership or effective control of The Park National Bank; or

		
	(f)
	the liquidation or dissolution of the Company.  

Notwithstanding the foregoing, with respect to the payment, exercise or settlement of any Award that is subject to Section 409A of the Code (and for which no exception applies), a Change in Control shall be deemed not to have occurred unless the events or circumstances constituting the Change in Control also constitute a “change in control event” within the meaning of Section 409A of the Code and the Treasury Regulations promulgated thereunder.
1.9“Code” means the Internal Revenue Code of 1986, as amended from time to time, or any successor thereto.
1.10“Committee” means the Board.
1.11“Common Shares” means the common shares, without par value, of the Company or any security of the Company issued in satisfaction, in exchange or in place of the Common Shares.
1.12“Company” means Park National Corporation, an Ohio corporation, and any successor thereto.

1.13“Director” means a person who is a member of the Board, excluding any member who is an Employee.  “Director” also means a non-employee member of the board of directors of a “subsidiary corporation” as defined in Section 424(f) of the Code or a non-employee member of the affiliate/advisory board of a division of such a “subsidiary corporation,” in each case who is not also a director of the Company.
1.14“Disability” means:
		
	(a)
	with respect to the payment, exercise or settlement of any Award that is (or becomes) subject to Section 409A of the Code (and for which no exception applies): (i) the Participant is unable to engage in any substantial gainful activity by reason of any medically determinable physical or mental impairment that can be expected to result in death or can be expected to last for a continuous period of not less than 12 months; or (ii) the Participant is determined to be totally disabled by the Social Security Administration; and

		
	(b)
	with respect to a Participant’s right to exercise or receive settlement of any Award or with respect to the payment, exercise or settlement of any Award not described in Section 1.14(a) of this Plan, a Participant’s inability (established by an independent physician selected by the Committee and reasonably acceptable to the Participant or to the Participant’s legal representative) due to illness, accident or otherwise to perform the Participant’s duties, which is expected to be permanent or for an indefinite duration longer than 12 months. 

1.15“Employee” means any person who is a common law employee of the Company or any Affiliate.  A person who is classified as other than a common law employee, but who is subsequently reclassified as a common law employee, of the Company or any Affiliate for any reason and on any basis shall be treated as a common law employee only from the date such reclassification occurs and shall not retroactively be reclassified as an Employee for any purpose under this Plan.
1.16“Fair Market Value” means the value of one Common Share on any relevant date, determined under the following rules:
		
	(a)
	If the Common Shares are traded on an exchange, the reported “closing price” on the relevant date if it is a trading day, otherwise on the immediately preceding trading day;

		
	(b)
	If the Common Shares are traded over-the-counter with no reported closing price, the mean between the lowest bid and the highest asked prices on that quotation system on the relevant date if it is a trading day, otherwise on the immediately preceding trading day; or

		
	(c)
	If neither Section 1.16(a) nor Section 1.16(b) of this Plan applies, (i) with respect to Options, Stock Appreciation Rights and any Award that is subject to Section 409A of the Code, the value as determined by the Committee through reasonable application of a reasonable valuation method, taking into account all information material to the value of the Company, within the meaning of Section 409A of the Code and the Treasury Regulations promulgated thereunder, and (ii) with respect to all other Awards, the fair market value as determined by the Committee in good faith.

1.17“Option” means an option to purchase Common Shares which is granted pursuant to Article V of this Plan.  For purposes of this Plan, an Option may only be a nonqualified stock option that is not intended to meet the requirements of Section 422 of the Code.
1.18“Other Stock-Based Award” means an Award granted pursuant to Article IX of this Plan.
1.19“Participant” means a Director who is granted an Award under this Plan.
1.20“Plan” means the Park National Corporation 2017 Long-Term Incentive Plan for Non-Employee Directors, as set forth herein and as may be amended from time to time.

1.21“Restricted Stock” means an Award granted pursuant to Article VII of this Plan through which a Participant is issued Common Shares which are subject to specified restrictions on vesting and transferability.
1.22“Restricted Stock Unit” means an Award granted pursuant to Article VIII of this Plan under which a Participant is issued a right to receive a specified number of Common Shares or a cash payment equal to a specified number of Common Shares, the settlement of which is subject to specified restrictions on vesting and transferability.
1.23“Retirement” means retirement as defined in the Award Agreement between the Participant and the Company.  
1.24“Stock Appreciation Right” means an Award granted pursuant to Article VI of this Plan through which a Participant is given the right to receive the difference between the Fair Market Value of a Common Share on the date of grant and the Fair Market Value of a Common Share on the date of exercise of the Award.
ARTICLE II 
COMMON SHARES SUBJECT TO PLAN
2.1Number of Common Shares Available for Awards.  Subject to this Article II, the aggregate number of Common Shares with respect to which Awards may be granted under this Plan shall be 150,000.  The Common Shares to be issued and delivered under this Plan may consist of either Common Shares currently held or Common Shares subsequently acquired by the Company as treasury shares, including Common Shares purchased in the open market or in private transactions.  No newly-issued Common Shares shall be delivered under this Plan.  Subject to this Article II: (a) the total number of Common Shares available for issuance under this Plan shall be reduced by the number of Common Shares subject to grant under an Award; and (b) any Common Shares underlying such Award that become available for future grant pursuant to Section 2.2 of this Plan shall be added back to this Plan in an amount equal to the number of Common Shares subject to such Award that become available for future grant under this Plan.  Without limiting the foregoing, with respect to any Stock Appreciation Right that is settled in Common Shares, the full number of Common Shares subject to the Award shall count against the number of Common Shares available for Awards under this Plan regardless of the number of Common Shares used to settle the Stock Appreciation Right upon exercise. 
2.2Share Usage.  In addition to the number of Common Shares provided for in Section 2.1 of this Plan, the following Common Shares shall be available for Awards under this Plan: (a) Common Shares covered by an Award that expires or is forfeited, canceled, surrendered or otherwise terminated without the issuance of such Common Shares; (b) Common Shares covered by an Award that, by the terms of the Award, may be settled only in cash; (c) Common Shares granted through the assumption of, or in substitution for, outstanding awards granted by another entity to individuals who become Directors as the result of a merger, consolidation, acquisition or other corporate transaction involving such other entity and the Company or any of the Affiliates; and (d) any Common Shares from Awards exercised for or settled in vested and nonforfeitable Common Shares that are later returned to the Company pursuant to any compensation recoupment policy, provision or agreement.  Nothing in the foregoing shall be construed as permitting any Common Shares surrendered upon exercise of an Award as payment of the applicable exercise price or withheld to satisfy any applicable taxes to again be available for Awards under this Plan.
2.3Fiscal Year Limits.  Subject to Section 2.4 of this Plan, during any fiscal year of the Company, the Committee may not: (a) make grants of all forms of Awards to all Participants in this Plan covering more than an aggregate of 15,000 Common Shares; or (b) make grants of all forms of Awards to a single Non-Employee Director Participant covering more than an aggregate of 1,000 Common Shares.  
2.4Adjustments.  In the event of any Common Share dividend or split, recapitalization (including payment of an extraordinary dividend), merger, reorganization, consolidation, combination, spin-off, distribution of assets to shareholders, exchange of Common Shares or any other change affecting the Common Shares, the Committee shall make such substitutions and adjustments, if any, as the Committee deems equitable and appropriate to (a) the aggregate number of Common Shares with respect to which Awards may be granted under this Plan, (b) any Common Share-based limits imposed under this Plan, and (c) the exercise price, number of Common Shares and other terms or limitations applicable to outstanding Awards.  Notwithstanding the foregoing, an adjustment pursuant to this Section 2.4 shall be made only to the extent such adjustment complies with Section 409A of the Code, to the extent applicable.

ARTICLE III 
ADMINISTRATION
3.1In General.  This Plan shall be administered by the Committee.  The Committee shall have full power and authority to: (a) interpret this Plan and any Award Agreement; (b) establish, amend and rescind any rules and regulations relating to this Plan; (c) select Participants; (d) establish the terms and conditions of any Award consistent with the terms and conditions of this Plan; and (e) make any other determinations that the Committee deems necessary or desirable for the administration of this Plan.  The Committee may correct any defect, supply any omission or reconcile any inconsistency in this Plan or in any Award Agreement in the manner and to the extent the Committee deems necessary or desirable.  Any decision of the Committee in the interpretation and administration of this Plan shall be made in the Committee’s sole and absolute discretion and shall be final, conclusive and binding on all persons.
3.2Delegation of Duties.  In the Committee’s sole discretion, the Committee may delegate any ministerial duties associated with this Plan to any person (including Employees) the Committee deems appropriate, including authority to execute Award Agreements on behalf of the Company or an Affiliate; provided, however, that the Committee may not delegate (a) any duties that the Committee is required to discharge to comply with Section 162(m) of the Code or any other applicable law, (b) the Committee’s authority to grant Awards to any Participant who is subject to Section 16 of the Act, and (c) the Committee’s authority under the Company’s equity award granting policy that may be in effect from time to time.
3.3Award Agreement.  The Committee will prepare and deliver an Award Agreement to each affected Participant that: (a) will describe the terms of the Award, including (i) the type of Award and when and how the Award may be exercised or earned, (ii) any exercise price associated with the Award, and (iii) how the Award will or may be settled; and (b) to the extent different from the terms of this Plan, will describe (I) any conditions that must be met before the Award may be exercised or earned, (II) any objective restrictions placed on an Award and any performance-related conditions that must be met before those restrictions will be released, and (III) any other applicable terms and conditions affecting the Award.  
ARTICLE IV 
ELIGIBILITY
Any Director selected by the Committee shall be eligible to be a Participant in this Plan.
ARTICLE V 
OPTIONS
5.1Grant of Options.  Subject to the terms and conditions of this Plan, Options may be granted to Participants in such number, and upon such terms and conditions, as determined by the Committee in the Committee’s sole discretion, to the extent that such terms and conditions are consistent with the provisions of this Article V and this Plan.
5.2Award Agreement.  Each Option shall be evidenced by an Award Agreement that specifies the exercise price, the term of the Option, the number of Common Shares covered by the Option, the conditions upon which the Option becomes vested and exercisable and such other terms and conditions as the Committee determines and which are not inconsistent with the terms and conditions of this Plan.    
5.3Exercise Price.  The exercise price per Common Share of an Option shall be determined by the Committee at the time the Option is granted and shall be specified in the related Award Agreement; provided, however, that in no event shall the exercise price of any Option be less than one hundred percent (100%) of the Fair Market Value of a Common Share on the date of grant.
5.4Term.  The term of an Option shall be determined by the Committee and set forth in the related Award Agreement; provided, however, that in no event shall the term of any Option exceed ten years from the date of grant of the Option.

5.5Exercisability.  Options shall become exercisable at such times and upon such terms and conditions as determined by the Committee and set forth in the related Award Agreement.  Such terms and conditions may include, without limitation, the satisfaction of (a) performance goals and (b) time-based vesting requirements.
5.6Exercise of Options.  Except as otherwise provided in this Plan or in a related Award Agreement, an Option may be exercised for all or any portion of the Common Shares for which the Option is then exercisable.  An Option shall be exercised by the delivery of a notice of exercise to the Company or the Company’s designee in a form specified by the Committee which sets forth the number of Common Shares with respect to which the Option is to be exercised and full payment of the exercise price for such Common Shares.  The exercise price of an Option may be paid (a) in cash or its equivalent, (b) by tendering (either by actual delivery or attestation) previously acquired Common Shares having an aggregate Fair Market Value at the time of exercise equal to the aggregate exercise price, provided that such Common Shares were held for at least six months or such other period required to obtain favorable accounting treatment, (c) by a cashless exercise (including by withholding Common Shares deliverable upon exercise and through a broker-assisted arrangement to the extent permitted by applicable law), (d) by a combination of the methods described in clauses (a), (b) and (c), or (e) though any other method approved by the Committee in the Committee’s sole discretion.  As soon as practicable after receipt of the notification of exercise and full payment of the exercise price, the Company shall cause the appropriate number of Common Shares to be issued to the Participant.
ARTICLE VI 
STOCK APPRECIATION RIGHTS
6.1Grant of Stock Appreciation Rights.  Subject to the terms and conditions of this Plan, Stock Appreciation Rights may be granted to Participants in such number, and upon such terms and conditions, as determined by the Committee in the Committee’s sole discretion, to the extent that such terms and conditions are consistent with the provisions of this Article VI and this Plan.
6.2Award Agreement.  Each Stock Appreciation Right shall be evidenced by an Award Agreement that specifies the exercise price, the term of the Stock Appreciation Right, the number of Common Shares covered by the Stock Appreciation Right, the conditions upon which the Stock Appreciation Right becomes vested and exercisable and such other terms and conditions as the Committee determines and which are not inconsistent with the terms and conditions of this Plan.
6.3Exercise Price.  The exercise price per Common Share of a Stock Appreciation Right shall be determined by the Committee at the time the Stock Appreciation Right is granted and shall be specified in the related Award Agreement; provided, however, that in no event shall the exercise price of any Stock Appreciation Right be less than one hundred percent (100%) of the Fair Market Value of a Common Share on the date of grant.
6.4Term.  The term of a Stock Appreciation Right shall be determined by the Committee and set forth in the related Award Agreement; provided however, that in no event shall the term of any Stock Appreciation Right exceed ten years from the date of grant of the Stock Appreciation Right.
6.5Exercisability of Stock Appreciation Rights.  A Stock Appreciation Right shall become exercisable at such times and upon such terms and conditions as determined by the Committee and set forth in the related Award Agreement.  Such terms and conditions may include, without limitation, the satisfaction of (a) performance goals and (b) time-based vesting requirements.
6.6Exercise of Stock Appreciation Rights.  Except as otherwise provided in this Plan or in a related Award Agreement, a Stock Appreciation Right may be exercised for all or any portion of the Common Shares for which the Stock Appreciation Right is then exercisable.  A Stock Appreciation Right shall be exercised by the delivery of a notice of exercise to the Company or the Company’s designee in a form specified by the Committee which sets forth the number of Common Shares with respect to which the Stock Appreciation Right is to be exercised.  Upon exercise, a Stock Appreciation Right shall entitle a Participant to an amount equal to (a) the excess of (i) the Fair Market Value of a Common Share on the exercise date over (ii) the exercise price per Common Share, multiplied by (b) the number of Common Shares with respect to which the Stock Appreciation Right is exercised.  A Stock Appreciation Right may 

be settled in full Common Shares, in cash or in a combination thereof, as specified by the Committee in the related Award Agreement.
ARTICLE VII 
RESTRICTED STOCK
7.1Grant of Restricted Stock.  Subject to the terms and conditions of this Plan, shares of Restricted Stock may be granted to Participants in such number, and upon such terms and conditions, as determined by the Committee in the Committee’s sole discretion, to the extent that such terms and conditions are consistent with the provisions of this Article VII and this Plan.
7.2Award Agreement.  Each Award of Restricted Stock shall be evidenced by an Award Agreement that specifies the number of shares of Restricted Stock, the restricted period(s) applicable to the shares of Restricted Stock, the conditions upon which the restrictions on the shares of Restricted Stock will lapse and such other terms and conditions as the Committee determines and which are not inconsistent with the terms and conditions of this Plan.
7.3Terms, Conditions and Restrictions.
		
	(a)
	In General.  The Committee shall impose such other terms, conditions or restrictions on any shares of Restricted Stock as the Committee may deem advisable, including, without limitation, a requirement that the Participant pay a purchase price for each share of Restricted Stock, restrictions based on the achievement of specific performance goals, time-based restrictions, holding requirements or sale restrictions placed on the underlying Common Shares by the Company upon vesting of such Restricted Stock.  

		
	(b)
	Retention  of Certificates.  To the extent deemed appropriate by the Committee, the Company may retain the certificates representing shares of Restricted Stock in the Company’s possession until such time as all terms, conditions and restrictions applicable to such shares of Restricted Stock have been satisfied or lapse.

		
	(c)
	Lapse of Restrictions.  Unless otherwise provided in the related Award Agreement or required by applicable law, the restrictions imposed on shares of Restricted Stock shall lapse upon the expiration or termination of the applicable restricted period and the satisfaction of any other applicable terms and conditions.

7.4Rights Associated with Restricted Stock during Restricted Period.  During any restricted period:
		
	(a)
	Non-Transferability.  The shares of Restricted Stock may not be sold, transferred, pledged, assigned or otherwise alienated or hypothecated; and

		
	(b)
	Voting of Restricted Stock.  Unless otherwise provided in the related Award Agreement, the Participant shall be entitled to exercise in full any voting rights associated with such shares of Restricted Stock.

		
	(c)
	Treatment of Dividends.  The Participant shall be entitled to all dividends and other distributions paid with respect to such shares of Restricted Stock during the restricted period; provided, however, that receipt of any such dividends or other distributions will be subject to the same terms and conditions as the shares of Restricted Stock with respect to which they are paid.  This means that cash dividends and dividends paid in Common Shares will be retained by the Company and subject to the same risk of forfeiture as the shares of Restricted Stock with respect to which the cash or Common Share dividends are paid until the underlying restrictions lapse and such retained dividends shall be forfeited to the extent that the Participant forfeits the shares of Restricted Stock on which the retained dividends were declared.  

ARTICLE VIII 
RESTRICTED STOCK UNITS
8.1Grant of Restricted Stock Units.  Subject to the terms and conditions of this Plan, Participants may be granted Restricted Stock Units in such number and upon such terms and conditions as determined by the Committee in the Committee’s sole discretion, to the extent that such terms and conditions are consistent with the provisions of this Article VIII and this Plan.
8.2Award Agreement.  Each Award of Restricted Stock Units shall be evidenced by an Award Agreement that specifies the number of Common Shares underlying the Award, the restricted period(s), the conditions upon which the restrictions on the Restricted Stock Units will lapse, the time at which and form in which the Restricted Stock Units will be settled, and such other terms and conditions as the Committee determines and which are not inconsistent with the terms and conditions of this Plan.
8.3Terms, Conditions and Restrictions.  The Committee shall impose such other terms, conditions and restrictions on any Award of Restricted Stock Units as the Committee may deem advisable, including, without limitation, restrictions based on the achievement of specific performance goals, time-based restrictions, holding requirements or sale restrictions placed on the underlying Common Shares by the Company upon vesting of such Restricted Stock Units.
8.4Form of Settlement.  An Award of Restricted Stock Units may be settled in full Common Shares, in cash or in a combination thereof, as specified by the Committee in the related Award Agreement.
8.5Dividend Equivalents.  Awards of Restricted Stock Units may provide the Participant with dividend equivalents, as determined by the Committee in the Committee’s sole discretion and as set forth in the related Award Agreement; provided, however, that such dividend equivalents shall be subject to the same terms and conditions, including the applicable forfeiture conditions, as the Restricted Stock Units.  This means that no amount shall be paid in connection with a dividend equivalent right until Common Shares are issued or cash is paid in connection with the Restricted Stock Units and any dividend equivalents shall be forfeited to the extent that the Participant forfeits the related Restricted Stock Units. 
8.6No Voting Rights.  In no event will a Participant have any voting rights with respect to the Common Shares underlying the Restricted Stock Units.
ARTICLE IX 
OTHER STOCK-BASED AWARDS
9.1Grant of Other Stock-Based Awards.  Subject to the terms and conditions of this Plan, Other Stock-Based Awards may be granted to Participants in such number, and upon such terms and conditions, as determined by the Committee in the Committee’s sole discretion, to the extent such terms and conditions are consistent with the provisions of this Article IX and this Plan.  Other Stock-Based Awards are Awards that are valued in whole or in part by reference to, or otherwise based on the Fair Market Value of, the Common Shares, and shall be in such form as the Committee determines, including, without limitation, unrestricted Common Shares.
9.2Award Agreement.  Each Other Stock-Based Award shall be evidenced by an Award Agreement that specifies the terms and conditions upon which the Other Stock-Based Award becomes vested, if applicable, the time and method of settlement, the form of settlement and such other terms and conditions as the Committee determines and which are not inconsistent with the terms and conditions of this Plan.  
9.3Form of Settlement.  An Other Stock-Based Award may be settled in full Common Shares, as specified by the Committee in the related Award Agreement.
9.4Dividend Equivalents.  Awards of Other Stock-Based Awards may provide the Participant with dividend equivalents, as determined by the Committee in the Committee’s sole discretion and as set forth in the related Award 

Agreement; provided, however, that such dividend equivalents shall be subject to the same terms and conditions, including the applicable forfeiture conditions, as the Other Stock-Based Award.  This means that no amount shall be paid in connection with a dividend equivalent right until Common Shares are issued or cash is paid in connection with the Other Stock-Based Award and any dividend equivalents shall be forfeited to the extent that the Participant forfeits the related Other Stock-Based Award.  
ARTICLE X 
CASH-BASED AWARDS
10.1Grant of Cash-Based Award.  Subject to the terms and conditions of this Plan, Cash-Based Awards may be granted to Participants in such amounts and upon such other terms and conditions as determined by the Committee in the Committee’s sole discretion.  
10.2Award Agreement.  Each Cash-Based Award shall be evidenced by an Award Agreement that specifies the payment amount or payment range, the time and method of settlement and the other terms and conditions, as applicable, of such Award, including, without limitation, performance objectives.
ARTICLE XI 
TERMINATION OF SERVICE
11.1In General.  With respect to each Award granted under this Plan, the Committee shall, subject to the terms and conditions of this Plan, determine the extent to which the Award shall vest and the extent to which the Participant shall have the right to exercise or receive settlement of the Award on or following the Participant’s termination of service with the Company or any of the Affiliates.  Such provisions shall be determined in the sole discretion of the Committee, shall be included in the related Award Agreement, need not be uniform among all Awards granted under this Plan and may reflect distinctions based on the reasons for termination. 
11.2Acceleration of Vesting.  Except as otherwise provided in this Plan, the vesting conditions of an Award may only be accelerated upon the death or termination due to Disability or Retirement, or involuntary termination without Cause of the Participant.  
ARTICLE XII 
CHANGE IN CONTROL
12.1Rights in Event of a Change in Control.  Except as otherwise provided in the related Award Agreement and subject to the provisions of Section 12.2 and Section 12.3 of this Plan, in the event of a Change in Control, the Committee, in the Committee’s sole discretion, may take any actions the Committee deems necessary or desirable with respect to any Award that is outstanding as of the date of the consummation of the Change in Control.  Such actions may include, without limitation (a) the acceleration of the vesting, settlement or exercisability of an Award as described in Section 12.2 of this Plan, (b) the payment of a cash amount in exchange for the cancellation of an Award, or (c) the issuance of substitute Awards that substantially preserve the value, rights and benefits of any Award affected by the Change in Control.  Any action relating to an Award that is subject to Section 409A of the Code shall be consistent with the requirements thereof. 
12.2Effect of Change in Control.  Except as otherwise provided in the related Award Agreement, in the event of a Change in Control, a Participant shall vest in all unvested Awards in full (and, if the Award was granted subject to the attainment of performance goals, as though the performance goals were achieved at the level of achievement which would have been achieved if the performance period had begun on the date the performance period actually commenced as provided in the related Award Agreement and ended on December 31 of the fiscal year most recently completed prior to the Change in Control) (a) if the Participant’s service is terminated for any reason other than for Cause within 12 months following the Change in Control or (b) if the Awards are canceled and the Participant is not granted substitute Awards that substantially preserve the value, rights and benefits of any affected Awards.

12.3Effect of Section 280G of the Code.  Unless specified otherwise in the related Award Agreement or in another written agreement between the Company or any Affiliate and a Participant, if the Company or any Affiliate concludes that any payment or benefit due to a Participant under this Plan, when combined with any other payment or benefit due to the Participant from the Company or any other entity (collectively, the “Payor”) would be considered a “parachute payment” as defined in Section 280G of the Code, the Payor will reduce the payments and benefits due to the Participant under this Plan to $1.00 less than the amount that would otherwise be considered a “parachute payment” within the meaning of Section 280G of the Code.  Any reduction pursuant to this Section 12.3 shall be made in compliance with Section 409A of the Code and the Treasury Regulations promulgated thereunder.  
ARTICLE XIII 
AMENDMENT OR TERMINATION OF THIS PLAN
13.1In General.  The Board may amend or terminate this Plan at any time; provided, however, that no amendment or termination may be made without the approval of the Company’s shareholders to the extent that (a) the amendment materially increases the benefits accruing to Participants under this Plan, (b) the amendment materially increases the aggregate number of Common Shares authorized for grant under this Plan (excluding an increase in the number of Common Shares with respect to which Awards may be granted under this Plan as a result of Section 2.4 of this Plan), (c) the amendment materially modifies the requirements as to eligibility for participation in this Plan, or (d) such approval is required by any law, regulation or stock exchange rule.
13.2Repricing.  Except in connection with a corporate transaction involving the Company (including, without limitation, any Common Share dividend, Common Share split, extraordinary cash dividend, recapitalization, reorganization, merger, consolidation, split-up, spin-off, combination or exchange of Common Shares), the terms of outstanding Awards may not be amended to reduce the exercise price of outstanding Options or SARs or cancel outstanding Options or SARs in exchange for cash, other awards or Options or SARs with an exercise price that is less than the exercise price of the original Options or SARs without shareholder approval.
ARTICLE XIV 
TRANSFERABILITY
14.1No Assignment or Transfer.  Except as described in Section 14.2 or as provided in a related Award Agreement, an Award may not be sold, transferred, pledged, assigned or otherwise alienated or hypothecated, except by will or the laws of descent and distribution and, during a Participant’s lifetime and an Award may be exercised only by the Participant or the Participant’s guardian or legal representative.  Notwithstanding any provision contained in this Article XIV, no Award may be transferred by a Participant for value or consideration.
14.2Restrictions on Resale or Other Disposition.  Any Award may be subject to such terms, conditions and restrictions on sale or transfer as the Committee deems appropriate and advisable, as specified by the Committee in the related Award Agreement.
14.3Beneficiary.  Unless otherwise specifically designated by the Participant in writing, a Participant’s beneficiary under this Plan shall be the Participant’s spouse or, if no spouse survives the Participant, the Participant’s estate.
ARTICLE XV 
MISCELLANEOUS
15.1No Right to Continued Service or to Awards.  The granting of an Award under this Plan imposes no obligation on the Company or any Affiliate to continue the service of a Participant nor interferes with or limits the right of the Company or any Affiliate to terminate the service of any Participant (to the extent permitted under applicable law).  In addition, no Director has any right to be granted any Award, and there is no obligation for uniformity of treatment of Participants.  The terms and conditions of Awards and the Committee’s interpretations and determinations with respect thereto need not be the same with respect to each Participant.

15.2Tax Withholding.
		
	(a)
	The Company or an Affiliate, as applicable, shall have the power and the right to deduct, withhold or collect any amount required by law or regulation to be withheld with respect to any taxable event arising with respect to an Award granted under this Plan.  This amount may, as determined by the Committee in the Committee’s sole discretion, be (i) withheld from other amounts due to the Participant, (ii) withheld from the value of any Award being settled or any Common Shares being transferred in connection with the exercise or settlement of an Award, (iii) withheld from the vested portion of any Award (including the Common Shares transferable thereunder), whether or not being exercised or settled at the time the taxable event arises, or (iv) collected directly from the Participant.

		
	(b)
	Subject to the approval of the Committee, a Participant may elect to satisfy the tax withholding requirement, in whole or in part, by having the Company or an Affiliate, as applicable, withhold Common Shares having a Fair Market Value on the date the tax is to be determined equal to the minimum statutory total tax that could be imposed on the transaction, or such higher withholding elected by the Participant provided that such higher withholding would not have a negative accounting impact for the Company or an Affiliate.  Any Common Shares to be withheld in accordance with this Section 15.2(b) must otherwise be distributable to the Participant at the time of the withholding or if such Common Shares are not otherwise distributable at the time of the withholding, the Participant must have a vested right to distribution of such Common Shares at such time.  All such elections shall be irrevocable and made in writing and shall be subject to any terms and conditions that the Committee, in the Committee’s sole discretion, deems appropriate.

15.3Requirements of Law.  The grant of Awards and the issuance of Common Shares shall be subject to all applicable laws, rules and regulations (including applicable federal and state securities laws) and to all required approvals of any governmental agencies or national securities exchange, market or other quotation system.  Without limiting the foregoing, the Company has no obligation to issue Common Shares under this Plan prior to (a) receipt of approvals from any governmental agency or stock exchange that the Committee deems necessary and (b) completion of registration or other qualification of the Common Shares under any applicable federal or state law or ruling of any governmental agency that the Committee deems necessary.
15.4Legends.  Certificates for Common Shares delivered under this Plan may be subject to such stop transfer orders and other transfer restrictions that the Committee deems advisable under the terms of this Plan or any Award Agreement or under the rules, regulations and other requirements of the Securities and Exchange Commission, any stock exchange upon which the Common Shares are then listed, or any other applicable federal or state securities law.  The Committee may cause a legend to be placed on any certificates issued under this Plan to make appropriate reference to restrictions within the scope of this Section.
15.5Uncertificated Common Shares.  To the extent that this Plan provides for the issuance of certificates to reflect the delivery of Common Shares, the delivery of Common Shares may be effected on a noncertificated basis, to the extent not prohibited by applicable law or the applicable rules of any stock exchange.
15.6Governing Law.  This Plan and all Award Agreements shall be governed by and construed in accordance with the laws (other than laws governing conflicts of laws) of the State of Ohio.
15.7No Impact on Benefits.  Awards are not compensation for purposes of calculating a Participant’s rights under any employee benefit plan that does not specifically require the inclusion of Awards in calculating benefits.
15.8Rights as a Shareholder.  Except as otherwise provided in this Plan or in a related Award Agreement, a Participant shall have none of the rights of a shareholder with respect to Common Shares covered by an Award unless and until the Participant becomes the record holder of such Common Shares.

15.9Successors and Assigns.  This Plan shall be binding on all successors and assigns of the Company and each Participant, including without limitation, the estate of such Participant and the executor, administrator or trustee of such estate, or any receiver or trustee in bankruptcy or representative of the Participant’s creditors. 
15.10Section 409A of the Code.
		
	(a)
	Awards granted pursuant to this Plan that are subject to Section 409A of the Code, or that are subject to Section 409A of the Code but for which an exception applies, are intended to comply with or be exempt from Section 409A of the Code and the Treasury Regulations promulgated thereunder, and this Plan shall be interpreted, administered and operated accordingly.

		
	(b)
	If a Participant is determined to be a “specified employee” (within the meaning of Section 409A of the Code and as determined under the Company’s policy for determining specified employees), the Participant shall not be entitled to payment or to distribution of any portion of an Award that is subject to Section 409A of the Code (and for which no exception applies) and is payable or distributable on account of the Participant’s “separation from service” (within the meaning of Section 409A of the Code) until the expiration of six months from the date of such separation from service (or, if earlier, the Participant’s death).  Such Award, or portion thereof, shall be paid or distributed on the first business day of the seventh month following such separation from service.

		
	(c)
	Nothing in this Plan shall be construed as an entitlement to or guarantee of any particular tax treatment to a Participant, and none of the Company, any Affiliate, the Board or the Committee shall have any liability with respect to any failure to comply with the requirements of Section 409A of the Code.

15.11Savings Clause.  In the event that any provision of this Plan shall be held illegal or invalid for any reason, the illegality or invalidity shall not affect the remaining provisions of this Plan, and this Plan shall be construed and enforced as if the illegal or invalid provision had not been included.
ARTICLE XVI 
EFFECTIVE DATE AND TERM OF THIS PLAN
16.1In General.  The effective date of this Plan is the date this Plan is approved by the Company’s shareholders.  No Awards shall be granted under this Plan after the tenth anniversary of the effective date of this Plan or, if earlier, the date this Plan is terminated.  Notwithstanding the foregoing, the termination of this Plan shall not preclude the Company from complying with the terms of Awards outstanding on the date this Plan terminates.Exhibit

EXECUTION COPY
CONFIDENTIAL

LOCAL COUNTRY AGREEMENT
[European Union]
This Local Country Agreement – European Union (this “Local Country Agreement”) is entered into effective November 1, 2016 (the “Local Country Agreement Date”), by and between Graphic Packaging International Europe NV, with offices at Fountain Plaza Belgicastraat 7 bus 5, 1930 Zaventem, Belgium (“Local GPI”), and Dell Corporation Ltd., a registered company under the law of England and Wales with offices at Dell House, The Boulevard, Cain Road, Bracknell, Berkshire, RG12 1LF (“Local Dell”) (Local GPI and Local Dell being the “Parties”, and each being a “Party” to this Local Country Agreement).
RECITALS:
Graphic Packaging International, Inc., a corporation formed in accordance with the laws of Delaware (“GPI”), and Dell Marketing L.P., a Texas limited partnership (“Dell”), are Parties to a Master Services Agreement (the “Master Services Agreement”) effective November 29, 2007 (together with any amendments thereto, and including the schedules and exhibits thereto, the "Agreement ");
The Agreement contemplates that, in the case of Service Recipients located outside of the United States, GPI or an Affiliate designated by GPI, and Dell or an Affiliate designated by Dell, may enter into a local country agreement for the provision of such Designated Services;
The purpose of this Local Country Agreement is to set forth the terms and conditions for Local Dell’s provision of the Designated Services as described in this Local Country Agreement to Service Recipients in the European Union as identified in Schedule 1.1(a) to the Master Services Agreement; 
In consideration of the promises contained in this Local Country Agreement and other good and valuable consideration, the receipt and sufficiency of which is hereby acknowledged, Local GPI and Local Dell agree as follows:
		
	1.
	GENERAL:

		
	1.1
	Incorporation of Agreement and Precedence of Obligations. Except as expressly modified or excluded in this Local Country Agreement, the terms and conditions of the Agreement will apply to, and are incorporated into, this Local Country Agreement. Local GPI and Local Dell agree that the terms and conditions of this Local Country Agreement shall consist of the terms and conditions of the Agreement, as modified and supplemented by this Local Country Agreement; and that they are bound by and subject to the terms and conditions of the Agreement, as modified and supplemented by this Local Country Agreement.  References in the Agreement to “GPI” mean Local GPI, references in the Agreement to “Dell” and “Perot Systems” mean Local Dell, and references in the Agreement to “Agreement” mean the Agreement as modified and supplemented by this Local Country Agreement, for the purposes of this Local Country Agreement.  In the event of a conflict between this Local Country Agreement and the Agreement, unless expressly specified otherwise, the terms of this Local Country Agreement will prevail.

		
	1.2
	References. All references in this Local Country Agreement to articles, sections and exhibits are to this Local Country Agreement, unless another reference is provided.

		
	1.3
	Definitions. Capitalized terms used in this Local Country Agreement, to the extent not otherwise defined in this Local Country Agreement, have the same meanings as in the Agreement.

		
	1.4
	Changes to the Agreement.  The Parties acknowledge and agree that GPI and Dell may modify the Agreement at any time. Local GPI and Local Dell agree to all of the terms and conditions set forth in the Agreement as so modified, and hereby consent to, agree to be bound by, and waive 

1

EXECUTION COPY
CONFIDENTIAL

notice of any extensions, deletions or other modifications of the terms and conditions of the Agreement properly made by GPI and Dell including, without limitation, any extension of the LCA Term under the terms of the Agreement.
		
	1
	TERM AND TERMINATION. 

		
	2.1
	Term.  The term of this Local Country Agreement (the “LCA Term”) will start on the Local Country Agreement Date and, unless terminated earlier pursuant to Article XV (Termination) of the Agreement or extended pursuant to Section 3 (Extension) of this Local Country Agreement, will continue until 11:59 p.m. Atlanta, Georgia time on January 31, 2022 (the “LCA Term Expiration Date”). For the avoidance of doubt, the terms and conditions of the Agreement will continue in full force and effect as to this Local Country Agreement for any period of time during which the LCA Term extends beyond the Term of the Agreement.

		
	2.2
	Termination.  

		
	(a)
	Local GPI may terminate: (a) this Local Country Agreement; or (b) any Service Tower under this Local Country Agreement, at any time following the Local Country Agreement Date for convenience by providing Dell with at least 120 days’ prior Notice of GPI’s intent to terminate and paying Local Dell the Termination Fee. In the case of the termination of this Local Country Agreement as a whole for convenience, upon its payment of the appropriate Termination Fee, Local GPI will be under no further obligation to pay any Charges arising from and after the date of termination.  In the case of the termination for convenience of less than all then-current Service Towers under this Local Country Agreement, upon its payment of the appropriate Termination Fee, Local GPI will be under no further obligation to pay any Charges arising from and after the date of termination with respect to the terminated Service Towers. 

		
	(b)
	For the avoidance of doubt, except as modified by Section 2.2 (Termination) of this Local Country Agreement, Article XV (Termination) of the Agreement will apply to this Local Country Agreement fully in accordance with its terms.

		
	(c)
	For purposes of this Local Country Agreement, “Termination Fee” means only the applicable fee set forth in Schedule 15.1.  For the avoidance of doubt, “Termination Fee” as used in this Local Country Agreement does not include Wind-down Expenses or any other fees, costs or expenses (other than any amounts specified in Schedule 15.1).  Section 15.11(a)(3) and Section 15.11(c) of the Agreement shall not apply to any termination pursuant to Section 2.2(a) of this Local Country Agreement.

		
	2
	INTENTIONALLY OMITTED.

		
	3
	LOCAL SERVICES. Local Dell will provide to the Service Recipients in the European Union identified in Schedule 1.1(a) to the Master Services Agreement the Designated Services described in Statement of Work No. 1 to this Local Country Agreement, in accordance with the applicable provisions of the Agreement.  For the purposes of this Local Country Agreement, the definition of “Designated Services” (as set out in Section 2.1 of the Agreement) shall be amended to exclude Sub-sections 2.1(1) and (2).  Local Dell will also timely perform or cause to be performed the obligations of Dell specified in the Agreement with respect to such Designated Services.

		
	4
	DATA PROTECTION.  In this Clause 5, the terms “data controller”, “data processor”, “personal data” and “processing” shall be as defined in the European Directive 95/46/EC on the protection of individuals with regard to the processing of personal data and on the free movement of such data (“Directive”) as amended or superseded (in particular by the General Data Protection Regulation (EU) 2016/679) from time to time. Local GPI shall comply with the provisions and 

2

EXECUTION COPY
CONFIDENTIAL

obligations imposed by the Directive (as implemented into applicable national laws) and, once it has entered into force, the General Data Protection Regulation (EU) 2016/679 in respect of the processing of the personal data.
		
	(a)
	Local GPI warrants and represents on behalf of itself and its Affiliates that it has obtained all necessary consents and permissions for lawful processing, prior to passing personal data to Local Dell.

		
	(b)
	Local Dell shall process the personal data only in accordance with Local GPI’s instructions and this Local Country Agreement. This Local Country Agreement and its annexes set out the scope of Local GPI’s complete and final instructions to Local Dell for the processing of personal data. Any additional or alternate instructions must be agreed between the Parties in writing, such agreement shall not be unreasonably withheld, delayed or denied by either Party.   To the extent Local Dell processes personal data as a data processor for Local GPI under or in connection with the Local Country Agreement, Local Dell shall take reasonable steps designed to ensure appropriate protection is in place to safeguard such personal data. For this reason Local Dell and Local GPI enter into a Data Processing Agreement which is attached as Annex 1 to this Local Country Agreement as a signed version. Service Recipients in the EEA/Switzerland as identified in Schedule 1.1(a) of the Agreement hereby accede to the Data Processing Agreement attached as Annex 1 to this Local Country Agreement and may directly enforce them against Local Dell with regard to the personal data they control as a data controller. 

		
	(c)
	Subject to section 21.4 of the Agreement, Local Dell must comply with any specific clauses that any applicable law enforcement authority (including the European Commission and the European Data Protection Supervisor) obligate or recommend are inserted into the Data Processing Agreement attached to this Local Country Agreement as Annex 1 and the Parties will amend it respectively.

		
	(d)
	Local Dell shall use its reasonable efforts to assist Local GPI to respond to requests for access to personal data which may be made by individuals to whom the personal data relates and where the personal data are held by Local Dell, subject to the payment by Local GPI of Local Dell’s reasonable professional charges for the time engaged by Local Dell staff in so doing.

		
	(e)
	Local GPI instructs and authorizes Local Dell to collect, use, store and transfer the personal data Local GPI provides to Local Dell for the purpose of and to the extent required to perform Local Dell’s obligations under the Local Country Agreement.

		
	(f)
	In case Local Dell uses sub-processors (including its Affiliates) to perform the services under this Local Country Agreement in accordance with Clause 11 of the Data Processing Agreement attached to the Local Country Agreement as Annex 1, Local Dell will flow down similar rights and obligations to its sub-processors as set out in this Section 5 (Data Protection), provided that in the case of Affiliates of Local Dell, the EU model clauses (2010/87/EU) in place between all Affiliates within the Dell group shall be adequate for this purpose.  If requested by Local GPI, Local Dell will procure that each sub-processor will enter into a data processing agreement as attached to this Local Country Agreement as Annex 1 with Local GPI and all Service Recipients located in the EEA/Switzerland as identified in Schedule 1.1(a) of the Agreement.   

		
	(g)
	Local Dell shall not be liable for any claim brought by Local GPI or a data subject arising from any action or omission by Local Dell to the extent that such action or omission resulted from compliance by Local Dell with Local GPI’s instructions.  Local Dell shall, 

3

EXECUTION COPY
CONFIDENTIAL

at its own expense, defend Local GPI against all losses, claims, costs, damages or proceedings suffered or incurred by Local GPI and/or its Affiliates by a third party arising out of or in connection with a breach by Local Dell and/or its sub-processors of its obligations set out in this clause 5 of this Local Country Agreement and the Data Processing Agreement attached as Annex 1 and Local Dell will pay any costs of settlement or any damages finally awarded against Dell. 
		
	(h)
	In the event of any conflict or inconsistency between this Local Country Agreement and the Agreement or the SOW, this Local Country Agreement shall prevail. In the event of any conflict or inconsistency between this Local Country Agreement and the Data Processing Agreement attached hereto as Annex 1, the Data Processing Agreement shall prevail.

		
	(i)
	Local Dell and all subcontractor(s) performing Designated Services under this Local Country Agreement are certified as compliant with ISO 27001:2013 by an accredited certification body, and will remain certified as compliant with ISO 27001:2013 (or a successor) at all times during the LCA Term.  Local Dell will provide all then-current certificates of compliance to Local GPI upon request.

		
	6.
	LOCAL GPI OBLIGATIONS.  Local GPI will timely perform or cause to be performed the obligations of GPI specified in the Agreement with respect to the Designated Services provided by Local Dell under this Local Country Agreement.

		
	7.
	LOCAL CHARGES. 

		
	7.1
	The Charges for the Designated Services to be provided by Local Dell under this Local Country Agreement are set forth Schedule 4.1 to the Agreement and in Statement of Work No. 1 to this Local Country Agreement. All Charges for the Designated Services under this Local Country Agreement are set out in Schedule 4.1 in U.S. Dollars.

		
	7.2
	Local Dell will invoice Local GPI for the Designated Services under this Local Country Agreement in Euro.  Each invoice shall be in the form of Annex 2 (Form of Invoice).  Local Dell will send all invoices to Local GPI addressed as follows:

Graphic Packaging International Europe NV
Attn: Accounts Payable
Belgicastraat 7 bus 5
1930 Zaventem
Belgium 
		
	7.3
	Currency Conversion.

		
	(a)
	Adjustment.  Starting on January 1, 2017, the Charges under this Local Country Agreement shall be converted from U.S. Dollars into Euro on a consecutive three-month basis in accordance with this Section 7.3.  The Charges in each Conversion Rate Period shall be subject to conversion from U.S. Dollars to Euro at the Average Exchange Rate calculated based on the immediately preceding Conversion Rate Period.  Notwithstanding the foregoing, Adjustments shall be subject to conversion from U.S. Dollars to Euro based on the Average Exchange Rate in effect during the Conversion Rate Period in which the Services giving rise to the Adjustment were performed.   

		
	(b)
	Average Exchange Rate.  The “Average Exchange Rate” shall be determined by calculating the average daily Exchange Rate in each Conversion Rate Period.  The Average 

4

EXECUTION COPY
CONFIDENTIAL

Exchange Rate will be calculated by dividing the sum of the daily Exchange Rates during the Conversion Rate Period by the number of days in that Conversion Rate Period.   

(c)    Examples.

		
	(i)
	Calculation of Average Exchange Rate.

If the sum of the daily Exchange Rates during the Conversion Rate Period starting July 1, 2017, and ending September 30, 2017, equals 82.8, then the Average Exchange Rate calculated on October 1, 2017, and applicable to the Charges under this Local Country Agreement during the Conversion Rate Period running from October 1, 2017, through December 31, 2017, will equal 0.90.  

[82.8 / 92 = Average Exchange Rate of 0.90]

82.8 = the sum of daily Exchange Rates in the Conversion Rate Period
92 = the number of calendar days in the Conversion Rate Period

		
	(ii)
	Conversion of Charges.

The Charges shall be converted from U.S. Dollars to Euro by multiplying the Charges as set out in Schedule 4.1 by the Average Exchange Rate calculated based on the immediately preceding Conversion Rate Period.  For example, if the EU Cloud Service Fee identified in Schedule 4.1 is US$89,245, and the Average Exchange Rate calculated based on the Conversion Rate Period of January 1, 2017, to March 31, 2017, is USD 1.00 = EUR 0.90, then the EU Cloud Service Fee each month for the Conversion Rate Period commencing on April 1, 2017, will equal €80,320.50.

 (d)    Definitions.

		
	(i)
	“Conversion Rate Period” means the three-month period starting on a Measurement Date and ending on the earlier of (A) the day before the next Measurement Date, or (B) the effective date of termination or expiration of the Local Country Agreement or the applicable Statement of Work.  Notwithstanding the foregoing, the initial Conversion Rate Period is October 1, 2016, to December 31, 2016.

		
	(ii)
	“Exchange Rate” means the exchange rate of U.S. Dollars to Euro published at http://www.bloomberg.com/markets/currencies (or any successor resource designated by Bloomberg L.P.) as the rate at “close,” represented by the number of Euro received in exchange for USD 1.00.  

		
	(iii)
	The “Measurement Dates” are January 1, April 1, July 1 and October 1 of each calendar year during the term of this Local Country Agreement. 

		
	7.4
	Taxes.

		
	(a)
	Allocation of Responsibility.   Except as provided in Section 6.2(e), Local GPI will be financially responsible for Taxes imposed on, based on, or measured by any consideration for any provision of services or transfer of property by Local Dell to Local GPI pursuant to this Local Country Agreement and for which Local Dell has an obligation under Law to collect such Taxes from Local GPI.  Local GPI shall not be financially responsible for (i) any penalties, interest and other charges related to Taxes, (ii) except as provided in Section 6.2(c), any taxes (including related interest, penalties, and additions to tax) not within the scope of the term Taxes as defined in this Local Country Agreement, including but not limited to, any and 

5

EXECUTION COPY
CONFIDENTIAL

all non-U.K. value added taxes, non-U.S. goods and services taxes, non-U.K. sales taxes and similar types of non-U.K. taxes which are imposed on, based on, or measured by any consideration for any provision of services or transfer of property by Local Dell to Local GPI as a result of Local Dell’s decision to provide any services from, or otherwise undertake any action in, a non-U.K. jurisdiction, (iii) any Taxes on any amounts (including but not limited to taxes) previously paid or incurred by Local Dell and that are passed through to and reimbursed by Local GPI, (iv) any Taxes that are imposed on Local Dell’s acquisition, ownership, or use of property or services in the course of providing property or services to Local GPI, (v) any Taxes imposed on, based on, or measured by any consideration for any provision of services by Local Dell to Local GPI pursuant to this Local Country Agreement and for which Local Dell has an obligation under Law to collect such Taxes from Local GPI and that arise as a result of Local Dell’s decision to provide any services from a jurisdiction other than the United Kingdom and (vi) any Taxes on any amounts owed by Local Dell to any subcontractor.  
		
	(b)
	Exemptions.  Notwithstanding anything to the contrary in this Local Country Agreement, Local GPI will not pay or reimburse Local Dell for any Taxes related to the provision of goods or services for which Local GPI provides Local Dell with a valid and applicable exemption certificate, multi-state benefit certificate, resale certificate, direct pay permit, or other reasonable evidence of exemption.  Each Party will make all reasonable efforts to accurately determine each Party’s tax liability and to minimize such liability to the extent legally permissible.

		
	(c)
	Property and Ad Valorem Taxes.  Local Dell will be responsible for reporting and payment of any real or personal property or ad valorem taxes due on property it owns and property or ad valorem taxes it otherwise has a responsibility under law to remit, and Local GPI will be responsible for reporting and payment of any real or personal property or ad valorem taxes due on property it owns and property or ad valorem taxes it otherwise has a responsibility under law to remit.  Each Party will bear sole responsibility for all taxes for franchise and privilege taxes on its business, and for taxes based on its net income.

		
	(d)
	Withholding Taxes.  Local Dell shall be financially responsible for any Withholding Tax liability asserted by any tax authority against Local GPI as a result of payments made by Local GPI to Local Dell under the terms of this Local Country Agreement.  Local GPI shall provide notice to Local Dell of any assertion of Withholding Tax liability by any tax authority and shall make available to Local Dell on a timely basis valid evidence of any Withholding Tax paid by Local GPI to such tax authority. 

		
	(e)
	Assessments.  Notwithstanding any other provision of this Local Country Agreement, if Local Dell receives notice from any taxing authority with respect to an assessment or potential assessment or imposition of any Tax that Local GPI would be financially responsible pursuant to this Section 6.2 (an “Assessed Tax”), Local Dell shall promptly send notice to Local GPI of such notice. Local Dell shall also provide the Local GPI tax department a copy of any such notice, which notice will be directed to the director of state taxes or comparable position.  To the extent directed by Local GPI in a notice sent to Local Dell, Local Dell shall timely contest (at Local GPI’s direction and expense relating to all actions to be taken to contest) such Assessed Tax with Local GPI’s participation, or, if Local GPI so directs, permit Local GPI to contest, to the extent permissible under applicable tax law and procedures, such Assessed Tax, at Local GPI’s expense, in a forum selected by Local GPI, and with counsel selected by Local GPI and reasonably acceptable to Local Dell, until Local GPI has decided to settle the matter or all appeals have been exhausted.  To the extent Local Dell contests an Assessed Tax at Local GPI’s direction, and such contest involves claims with respect to taxes or Taxes for which Local GPI would not be financially responsible pursuant to this Section 6.2, Local GPI shall be responsible only for that portion of Local Dell’s expenses as 

6

EXECUTION COPY
CONFIDENTIAL

are reasonably allocable to the contest of the Assessed Tax.  Local Dell may not compromise, settle, or resolve a contest with respect to such Assessed Tax under this Section 6.2(e) without Local GPI’s Consent.  Notwithstanding any provision in this Local Country Agreement to the contrary, with respect to any Assessed Tax, if Local Dell fails to comply with any of the requirements of this Section 6.2(e), such Assessed Tax shall not be a Tax for which Local GPI is financially responsible under Section 6.2. 
		
	(f)
	Refunds and Rebates.  Local GPI will be entitled to any Tax refunds or rebates granted to the extent such refunds or rebates are of Taxes that were the responsibility of Local GPI under this Local Country Agreement.  Local GPI may require Local Dell to choose and perform one of the following: (i) apply for and diligently pursue, at Local GPI’s expense, a refund of Taxes paid by Local GPI; (ii) if permitted by Law, assign its rights to a refund claim for such Taxes to Local GPI; or (iii) in the event that Local Dell has already received a refund or rebate of any Tax for which Local GPI was responsible under this Local Country Agreement, pay to Local GPI the amount of such Taxes refunded to Local Dell and any interest received thereon.

		
	(g)
	Cooperation.  The Parties agree to reasonably cooperate with each other to enable each to more accurately determine its own Tax Liabilities and to minimize such Taxes incurred in connection with this Local Country Agreement to the extent legally possible.  Such cooperation shall include, but not be limited to, preparation of Invoices in accordance with Section 4.2(b), and maintaining data, as reasonably necessary for Tax compliance purposes, making such data available to the other Party (or permitting the other Party to copy, at the requesting Party’s expense, such data), and making information in its possession and employees with technical expertise available (at the providing Party’s reasonable cost) as reasonably necessary in connection with the preparation of any Tax returns or any audit, contest or refund claim related to Taxes. 

		
	(h)
	Indemnification of GPI Indemnitees.  Local Dell shall indemnify, defend and hold harmless the Local GPI and its officers, directors and Affiliates from and against all Losses (including fines and penalties) (i) for property taxes, Withholding Taxes, taxes, and Taxes for which Local GPI is not financially responsible under this Local Country Agreement, including any interest, penalties, and other charges related thereto, (ii) arising from any Governmental Authority’s reclassification or attempt to reclassify any of Local Dell’s personnel, agents, subcontractors or suppliers as an employee of Local GPI or any of Local GPI’s Affiliates, including without limitation, any tax liability (including interest and penalties) resulting from Local GPI’s or any such Affiliate’s failure to pay, deduct or withhold any income or employment-related taxes with respect to any of Local Dell’s personnel, agents, subcontractors or suppliers, (iii) for penalties, interest and other charges related to Taxes, and (iv) for taxes that any non-U.K. taxing authority assesses, levies or charges Local GPI in any jurisdiction outside the United Kingdom from which services are provided by reason of the provision of the Designated Services by Local Dell to Local GPI. 

		
	(i)
	Indemnification of Dell Indemnitees.  Local GPI will indemnify, defend and hold harmless Local Dell and its officers, directors and Affiliates from and against all Losses (including fines, interest, and penalties) for Taxes, property taxes, Withholding Taxes, interest and penalties assessed or claimed against Local Dell for which Local GPI is financially responsible under this Agreement.

		
	(j)
	Definitions.  For purposes of this Local Country Agreement, the following definitions shall apply:

		
	(i)
	“Tax” or “Taxes” means U.K. value added, goods and services, sales, use, excise, and other similar types of U.K. transfer taxes, fees or charges (excluding any related 

7

EXECUTION COPY
CONFIDENTIAL

penalties, additions to tax, and interest), however designated or imposed, which are in the nature of a transaction tax, fee or charge, but not including any such taxes, duties, fees or charges imposed on or measured by net or gross income or gross receipts (other than any such taxes which are in the nature of transaction taxes of the type listed above), capital stock or net worth, or that are in the nature of an income, capital, franchise, or net worth tax.  
		
	(ii)
	“Withholding Taxes” means non-U.K. and U.K. federal, state and local taxes, fees, or charges which are imposed on or by reference to gross or net income or gross or net receipts and are required by any Governmental Authority to be withheld by Local GPI from payments made to Local Dell under this Local Country Agreement (including any related penalties and interest thereon).

		
	(k)
	Survival.  The Parties’ obligations under Section 6.2 survive any expiration or termination of this Local Country Agreement.

		
	7.5
	Unless otherwise specified in this Local Country Agreement, the responsibilities of each Party for invoicing and payment for Designated Services provided under this Local Country Agreement will be as set forth in the Agreement.

		
	8.
	HR PROVISIONS. The parties have agreed the provisions set out in the attached HR Provisions Schedule, which is hereby incorporated into this Local Country Agreement. 

		
	9.
	DISPUTES AND JURISDICTION. For avoidance of doubt, any dispute arising under this Local Country Agreement will be resolved in accordance with the provisions of Schedule 3.2 (Account Governance) and Schedule 20.1 (Dispute Resolution Procedure) of the Agreement.

		
	10.
	GOVERNING LAW. Except as otherwise provided in this Local Country Agreement, this Local Country Agreement and performance under it wiII be governed by and construed in accordance with the applicable laws of the state of Georgia, without giving effect to the principles thereof relating to conflicts of laws. The application of the United Nations Convention on Contracts for the International Sale of Goods is expressly excluded. Notwithstanding the foregoing, if any provision of this Local Country Agreement is expressly required by the laws of England and Wales to be subject to specific laws of England and Wales and the applicability of such mandatory laws is not subject to contractual waiver or limitation, the construction, interpretation and performance of such provision will be governed by the internal mandatory laws of England and Wales (without reference to choice or conflict of laws).

		
	11.
	NOTICE. Each Party will comply with the notice provisions of Section 21 .8 of the Agreement for all notices to the other Party that are related to this Local Country Agreement.

		
	12.
	COUNTERPARTS. This Local Country Agreement may be executed in several counterparts, all of which taken together will constitute one single agreement between the parties hereto.

		
	13.
	SEVERABILITY. In the event that any provision of this Local Country Agreement conflicts with the law under which this Local Country Agreement is to be construed or if any such provision is held invalid or unenforceable by a court with jurisdiction over the parties hereto, such provision will be deemed to be restated to reflect as nearly as possible the original intentions of the Parties in accordance with applicable law. The remaining provisions of this Local Country Agreement and the application of the challenged provision to persons or circumstances other than those as to which it is invalid or unenforceable will not be affected thereby, and each such provision will be valid and enforceable to the full extent permitted by law.

8

EXECUTION COPY
CONFIDENTIAL

		
	14.
	NO THIRD PARTY RIGHTS.  This Local Country Agreement is entered into solely between, and may be enforced only by, Local Dell and Local GPI, and this Agreement will not be deemed to create any rights in Third Parties, including employees, suppliers or subcontractors of a Party, or to create any obligations of a Party to any such Third Parties. Nothing in this Section 14, however, is intended to contravene a Party’s obligation to the other Party to indemnify the other Party’s Indemnitees, or Dell’s obligation to Local GPI to provide the Designated Services to Service Recipients.

		
	15.
	ENTIRE AGREEMENT. Together with the Agreement, this Local Country Agreement constitutes the entire agreement between the Parties with respect to the subject matter hereof. There are no agreements, representations, warranties, promises, covenants, commitments or undertakings other than those expressly set forth herein and therein.  This Local Country Agreement supersedes all prior agreements, representations, warranties, promises, covenants, commitments or undertakings, whether written or oral, with respect to the subject matter contained in this Local Country Agreement. No amendment, modification, change, waiver, or discharge hereof will be valid unless in  writing and signed by an authorized representative of the Party against which such amendment, modification, change, waiver, or discharge is sought to  be  enforced  (except, however, that amendments to the Agreement will be applicable to this Local Country Agreement). No “click-wrap”, “shrink-wrap” or other agreement, notice or terms that accompany the Designated Services shall be effective, nor shall Local GPI’s consent to any such click-wrap, shrink-wrap or other agreement be required for Local GPI to receive the Designated Services. Local Dell (and, for avoidance of doubt, Local Dell’s Affiliates or subcontractors) will not present any terms and conditions, terms of use or agreements to Service Recipient in connection with the Services.

IN WITNESS WHEREOF, Local GPI and Local Dell have each caused this Local Country Agreement to be executed by their respective duly authorized representatives on the dates set forth below to be effective as of the Local Country Agreement Date.

	
		
	GRAPHIC PACKAGING INTERNATIONAL
EUROPE NV 
By:      
Name:   
Title:      
Date:    

	DELL CORPORATION LTD. 

By:      
Name:   
Title:      
Date:    
      

9

EXECUTION COPY
CONFIDENTIAL

HR PROVISIONS SCHEDULE
Application of Transfer Regulations on commencement 
		
	1.1
	It is not the intention of the Parties that any individual employed or engaged by GPI, any GPI Affiliate and/or any of their subcontractors will transfer to Dell or any of its Affiliates (or any of their subcontractors) pursuant to the Transfer Regulations on commencement of the Designated Services under the Agreement. 

		
	1.2
	If any individual asserts the transfer of his or her employment relationship to Dell or any of Dell's Affiliates or any of their subcontractors or makes any claims relating to an employment relationship against any such entity (an “Unintended GPI Transfer”) and Dell, its relevant Affiliate or their subcontractors (as appropriate) in its or their sole discretion does not wish to employ the Unintended GPI Transfer, then:

		
	1.3
	Dell shall (or shall procure that the Dell Affiliate or relevant subcontractor shall) notify GPI in writing within five business days after becoming aware of such assertions or claims; 

		
	1.4
	GPI, the relevant GPI Affiliate and/or their subcontractors (as appropriate) may offer to re-employ  the Unintended GPI Transfer within 15 business days of the notification by Dell in Section 2.1 or take such other steps as it or they considers appropriate; and

		
	1.5
	if such offer of employment is accepted, or if the situation has otherwise been resolved, Dell shall (or shall procure that the Dell Affiliate or relevant subcontractor, as appropriate, shall) immediately release the person from his/her purported employment.

		
	1.6
	In the event that after the 15 day business period specified in Section 2.2 above has elapsed, no offer of employment has been made or such offer has been made but not accepted or the situation has not otherwise been resolved, Dell, the Dell Affiliate or relevant subcontractor (as appropriate) may within five business days give notice to terminate the employment of such Unintended GPI Transfer. 

		
	1.7
	Subject to Sections 2 and 3 above, GPI shall (and shall procure that the relevant GPI Affiliate shall) indemnify Dell, each Affiliate of Dell and all of their subcontractors from and keep them indemnified against:

		
	1.8
	all losses, liabilities, costs, awards, damages, fines, penalties, sanctions, amounts paid in settlement and expenses (including reasonable legal fees for both internal and external counsel, and reasonable costs of investigation, litigation and settlement) arising in connection with or as a result of any claim or demand by or on behalf of any Unintended GPI Transfer in relation to any act or omission occurring prior to or on the date on which the employment of the Unintended GPI Transfer transferred to Dell, any Affiliate of Dell or any of their sub-contractors, including a failure to inform or consult with its employees or their representatives in accordance with the Transfer Regulations; and

		
	1.9
	all losses, liabilities, costs, awards, damages (including any statutory redundancy payments, any enhanced redundancy payments, pension and retirement-related liability and any awards made by an employment tribunal for a basic award or compensation for unfair dismissal), fines, penalties, sanctions, amounts paid in settlement or by way of a settlement agreement and expenses (including reasonable legal fees for both internal and external counsel, and reasonable costs of investigation, litigation and settlement) arising in connection with any employment and termination of employment of an Unintended GPI Transfer by Dell, any Affiliate of Dell or any of their sub-contractors, as appropriate, in accordance with Section 3 above.

10

EXECUTION COPY
CONFIDENTIAL

		
	1.10
	The indemnity in Section 4 above will not apply to any claim by any person in respect of whom the notification given by Dell under Section 2.1 is received by GPI more than six calendar months after the Local Country Agreement Date.

Application of Transfer Regulations on exit
		
	1.11
	It is not the intention of the Parties that any individual employed or engaged by Dell, any Dell Affiliate and/or any of their subcontractors will transfer to GPI, its Affiliates or any Replacement Service Provider pursuant to Transfer Regulations on the termination or expiry of the Designated Services (in whole or in part) under the Agreement. 

		
	1.12
	If any individual asserts the transfer of his or her employment relationship to GPI or any of GPI's Affiliates or any Replacement Service Provider or makes any claims relating to an employment relationship against any such entity (an “Unintended Dell Transfer”) and GPI, its relevant Affiliate or their subcontractors (as appropriate) in its or their sole discretion does not wish to employ the Unintended Dell Transfer, then:

		
	1.13
	GPI shall (or shall procure that the GPI Affiliate or Replacement Service Provider shall) notify Dell in writing within five business days after becoming aware of such assertions or claims; 

		
	1.14
	Dell, the relevant Dell Affiliate and/or their subcontractors (as appropriate) may offer to re-employ  the Unintended Dell Transfer within 15 business days of the notification in Section 8.1 or take such other steps as it or they considers appropriate; and

		
	1.15
	if such offer of employment is accepted, or if the situation has otherwise been resolved, GPI shall (or shall procure that the GPI Affiliate or Replacement Service Provider, as appropriate, shall) immediately release the person from his/her purported employment.

		
	1.16
	In the event that after the 15 day business period specified in Section 8.2 above has elapsed, no offer of employment has been made or such offer has been made but not accepted or the situation has not otherwise been resolved, GPI, the GPI Affiliate or Replacement Service Provider (as appropriate) may within five business days give notice to terminate the employment of such Unintended Dell Transfer. 

		
	1.17
	Subject to Sections 8 and 9 above, Dell shall indemnify GPI, each Affiliate of GPI and any Replacement Service Provider from and keep them indemnified against:

		
	1.18
	all losses, liabilities, costs, awards, damages, fines, penalties, sanctions, amounts paid in settlement and expenses (including reasonable legal fees for both internal and external counsel, and reasonable costs of investigation, litigation and settlement) arising in connection with or as a result of any claim or demand by or on behalf of any Unintended Dell Transfer in relation to any act or omission occurring prior to or on the date on which the employment of the Unintended Dell Transfer transferred to GPI, any Affiliate of GPI or any Replacement Service Provider, as appropriate, including a failure to inform or consult with its employees or their representatives in accordance with the Transfer Regulations; and

		
	1.19
	all losses, liabilities, costs, awards, damages (including any statutory redundancy payments, any enhanced redundancy payments, pension and retirement-related liability and any awards made by an employment tribunal for a basic award or compensation for unfair dismissal), fines, penalties, sanctions, amounts paid in settlement or by way of a settlement agreement and expenses (including reasonable legal fees for both internal and external counsel, and reasonable costs of investigation, litigation and settlement) arising in connection with any employment and termination of employment of an Unintended Dell Transfer by GPI, any Affiliate of GPI or any Replacement Service Provider, as appropriate, in accordance with Section 9 above.

11

EXECUTION COPY
CONFIDENTIAL

		
	1.20
	The indemnity in Section 9 above will not apply to any claim by any person in respect of whom the notification given by GPI under Section 7.1 is received by Dell more than six calendar months after the expiry or termination of the Local Country Agreement.

General 
		
	1.21
	This HR Provisions Schedule shall be governed by and construed in all respects in accordance with the laws of England. Each of the parties hereto hereby irrevocably submits to the non-exclusive jurisdiction of the English Courts in respect of this HR Provisions Schedule only.  

		
	1.22
	In this HR Provisions Schedule, the following expressions have the following meanings:

“Transfer Regulations” means the Transfer of Undertakings (Protection of Employment) Regulations 2006, as amended or restated from time to time; and
"Replacement Service Provider" means a supplier engaged to provide services in replacement for the Designated Services (in whole or in part).

ANNEX 1 to the LOCAL COUNTRY AGREEMENT: Data Processing Agreement
Controller to Processor or Sub-processor Agreement
For the purposes of accommodating local data protection requirements and the requirements of the General Data Protection Regulation (Regulation (EU) 2016/679) (“GDPR”) and of Article 26(2) of Directive 95/46/EC for the transfer of personal data to processors established in third countries which do not ensure an adequate level of data protection, the Parties have agreed on the following Contractual Clauses (the "Clauses") in order to adduce adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals for the transfer by the data exporter to the data importer of the personal data specified in Appendix 1.
Clause 1  
Definitions
For the purposes of the Clauses:
		
	(a)
	"personal data", "special categories of data", "process/processing", "controller", "processor", "data subject" and "supervisory authority" shall have the same meaning as in Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data;

		
	(b)
	"the data exporter" shall mean the controller who transfers the personal data;

		
	(c)
	"the data importer" shall mean the processor who agrees to receive from the data exporter personal data intended for processing on his behalf after the transfer in accordance with his instructions and the terms of these Clauses and who is not subject to a third country's system ensuring to adequate protection within the meaning of Article 25(1) of Directive 95/46/EC;

		
	(d)
	"the sub-processor" means any processor engaged by the data importer or by any other sub-processor of the data importer who agrees to receive from the data importer or from any other sub-processor of the data importer personal data exclusively intended for processing activities to be carried out on behalf of the data exporter after the transfer in accordance with his instructions, the terms of the Clauses and the terms of the written subcontract;

		
	(e)
	"the applicable data protection law" means the legislation protecting the fundamental rights and freedoms of individuals and, in particular, their right to privacy with respect to the processing of personal data applicable to a data controller in the Member State in which the data exporter is established; and

		
	(f)
	"technical and organisational security measures" means those measures aimed at protecting personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access, in particular where the processing involves the transmission of data over a network, and against all other unlawful forms of processing.

Clause 2
Details of the transfer
The details of the transfer and in particular the special categories of personal data where applicable are specified in Appendix 1 which forms an integral part of the Clauses.
Clause 3
Third-party beneficiary clause
		
	1.
	The data subject can enforce against the data exporter this Clause, Clause 4(b) to (i), Clause 5(a) to (e), and (g) to (j), Clause 6(1) and (2), Clause 7, Clause 8(2), and Clauses 9 to 12 as third-party beneficiary.

		
	2.
	The data subject can enforce against the data importer this Clause, Clause 5(a) to (e) and (g), Clause 6, Clause 7, Clause 8(2), and Clauses 9 to 12, in cases where the data exporter has factually disappeared or has ceased to exist in law unless any successor entity has assumed the entire legal obligations of the data exporter by contract or by operation of law, as a result of which it takes on the rights and obligations of the data exporter, in which case the data subject can enforce them against such entity.

		
	3.
	The data subject can enforce against the sub-processor this Clause, Clause 5(a) to (e) and (g), Clause 6, Clause 7, Clause 8(2), and Clauses 9 to 12, in cases where both the data exporter and the data importer have factually disappeared or ceased to exist in law or have become insolvent, unless any successor entity has assumed the entire legal obligations of the data exporter by contract or by operation of law as a result of which it takes on the rights and obligations of the data exporter, in which case the data subject can enforce them against such entity. Such third-party liability of the sub-processor shall be limited to outs own processing operations under the Clauses.

		
	4.
	The Parties do not object to a data subject being represented by an association or other body if the data subject so expressly wishes and if permitted by national law.

Clause 4
Obligations of the data exporter
The data exporter agrees and warrants:
		
	(a)
	that the processing, including the transfer itself, of the personal data has been and will continue to be carried out in accordance with the relevant provisions of the applicable data protection law (and, where applicable, has been notified to the relevant authorities of the Member State where the data exporter is established) and does not violate the relevant provisions of that State;

		
	(b)
	that it has instructed and throughout the duration of the personal data processing services will instruct the data importer to process the personal data transferred only on the data exporter's behalf and in accordance with the applicable data protection law and the Clauses;

		
	(c)
	that the data importer will provide sufficient guarantees in respect of the technical and organisational security measures specified in Appendix 2 to this Schedule 4;

		
	(d)
	that after assessment of the requirements of the applicable data protection law, the security measures are appropriate to protect personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access, in particular where the processing involves the transmission of data over a network, and against all other unlawful forms of processing, and that these measures ensure a level of security appropriate to the risks presented by the processing and the nature of the data to be protected having regard to the state of the art and the cost of their implementation;

		
	(e)
	that it will ensure compliance with the security measures;

		
	(f)
	that, if the transfer involves special categories of data, the data subject has been informed or will be informed before, or as soon as possible after, the transfer that its data could be transmitted to a third country not providing adequate protection within the meaning of Directive 95/46/EC;

		
	(g)
	to forward any notification received from the data importer or any sub-processor pursuant to Clause 5(b) and Clause 8(3) to the data protection supervisory authority if the data exporter decides to continue the transfer or to lift the suspension;

		
	(h)
	to make available to the data subjects upon request a copy of the Clauses, with the exception of Appendix 2, and a summary description of the security measures, as well as a copy of any contract for sub-processing services which has to be made in accordance with the Clauses, unless the Clauses or the contract contain commercial information, in which case it may remove such commercial information;

		
	(i)
	that, in the event of sub-processing, the processing activity is carried out in accordance with Clause 11 by a sub-processor providing at least the same level of protection for the personal data and the rights of data subject as the data importer under the Clauses; and

		
	(j)
	that it will ensure compliance with Clause 4(a) to (i). 

Clause 5
Obligations of the data importer
The data importer agrees and warrants:
		
	(a)
	to process the personal data only on behalf of the data exporter and in compliance with its instructions and the Clauses; if it cannot provide such compliance for whatever reasons, it agrees to inform promptly the data exporter of its inability to comply, in which case the data exporter is entitled to suspend the transfer of data and/or terminate the contract;

		
	(b)
	that it has no reason to believe that the legislation applicable to it prevents it from fulfilling the instructions received from the data exporter and its obligations under the contract and that in the event of a change in this legislation which is likely to have a substantial adverse effect on the warranties and obligations provided by the Clauses, it will promptly notify the change to the data exporter as soon as it is aware, in which case the data exporter is entitled to suspend the transfer of data and/or terminate the contract;

		
	(c)
	that it has implemented the technical and organisational security measures specified in Appendix 2 before processing the personal data transferred;

		
	(d)
	that it will promptly notify the data exporter about:

		
	(i)
	any legally binding request for disclosure of the personal data by a law enforcement authority unless otherwise prohibited, such as a prohibition under criminal law to preserve the confidentiality of a law enforcement investigation;

		
	(ii)
	any accidental or unauthorised access; and

		
	(iii)
	any request received directly from the data subjects without responding to that request, unless it has been otherwise authorised to do so;

		
	(e)
	to deal promptly and properly with all inquiries from the data exporter relating to its processing of the personal data subject to the transfer and to abide by the advice of the supervisory authority with regard to the processing of the data transferred;

		
	(f)
	at the request of the data exporter to submit its data processing facilities for audit of the processing activities covered by the Clauses which shall be carried out by the data exporter or an inspection body composed of independent members and in possession of the required professional qualifications bound by a duty of confidentiality, selected by the data exporter, where applicable, in agreement with the supervisory authority;

		
	(g)
	to make available to the data subject upon request a copy of the Clauses, or any existing contract for sub-processing, unless the Clauses or contract contain commercial information, in which case it may remove such commercial information, with the exception of Appendix 2 which shall be replaced by a summary description of the security measures in those cases where the data subject is unable to obtain a copy from the data exporter;

		
	(h)
	that, in the event of sub-processing, it has previously informed the data exporter and obtained its prior written consent;

		
	(i)
	that the processing services by the sub-processor will be carried out in accordance with Clause 11; and

		
	(j)
	to send promptly a copy of any sub-processor agreement it concludes under the Clauses to the data exporter.

Clause 6  
Liability
		
	1.
	The Parties agree that a data subject, who has suffered damage as a result of any breach of the obligations referred to in Clause 3 or in Clause 11 by any party or sub-processor is entitled to receive compensation from the data exporter for the damage suffered.

		
	2.
	If a data subject is not able to bring a claim for compensation in accordance with paragraph 1 against the data exporter, arising out of a breach by the data importer or his sub-processor of any of their obligations referred to in Clause 3 or in Clause 11, because the data exporter has factually disappeared or ceased to exist in law or has become insolvent, the data importer agrees that the data subject may issue a claim against the data importer as if it were the data exporter, unless any successor entity has assumed the entire legal obligations of the data exporter by contract or by operation of law, in which case the data subject can enforce its rights against such entity.

The data importer may not rely on a breach by a sub-processor of its obligations in order to avoid its own liabilities.
		
	3.
	If a data subject is not able to bring a claim against the data exporter or the data importer referred to in paragraphs 1 and 2, arising out of a breach by the sub-processor of any of their obligations referred to in Clause 3 or in Cause 11 because both the data exporter and the data importer have factually disappeared or ceased to exist in law or have become insolvent, the sub-processor agrees that the data subject may issue a claim against the data sub-processor with regard to its own processing operations under the Clauses as if it were the data exporter or the data importer, unless any successor entity has assumed the entire legal obligations of the data exporter or data importer by contract or by operation of law, in which case the data subject an enforce its rights against such entity. The liability of the sub-processor shall be limited to its own processing operations under the Clauses.

Clause 7
Mediation and jurisdiction
		
	1.
	The data importer agrees that if the data subject invokes against it third-party beneficiary rights and/or claims compensation for damages under the Clauses, the data importer will accept the decision of the data subject:

		
	(a)
	to refer the dispute to mediation, by an independent person or, where applicable, by the supervisory authority;

		
	(b)
	to refer the dispute to the courts in the Member State in which the data exporter is established.

		
	2.
	The Parties agree that the choice made by the data subject will not prejudice its substantive or procedural rights to seek remedies in accordance with other provisions of national or international law.

Clause 8
Cooperation with supervisory authorities
		
	1.
	The data exporter agrees to deposit a copy of this contract with the supervisory authority if it so requests or if such deposit is required under the applicable data protection law.

		
	2.
	The Parties agree that the supervisory authority has the right to conduct an audit of the data importer, and of any sub-processor, which has the same scope and is subject to the same conditions as would apply to an audit of the data exporter under the applicable data protection law.

		
	3.
	The data importer shall promptly inform the data exporter about the existence of legislation applicable to it or any sub-processor preventing the conduct of an audit of the data importer, or any sub-processor, pursuant to paragraph 2. In such a case the data exporter shall be entitled to take the measures foreseen in Clause 5(b).

Clause 9
Governing law
The Clauses shall be governed by the law of the Member State in which the data exporter is established.
Clause 10
Variation of the contract
		
	1.
	The Parties undertake not to vary or modify the Clauses. This does not preclude the Parties from adding clauses on business related issues where required as long as they do not contradict the Clauses.

		
	2.
	The following commercial clauses have been added as new clauses:

		
	(a)
	Term of the Clauses: The term of these Clauses corresponds to the term of the Local Country Agreement (“LCA”) entered into by Graphic Packaging International Europe S.A. and Dell Corporation Ltd. These Clauses shall automatically terminate upon any termination or expiration of the LCA.

		
	(b)
	Correcting, Blocking, and Deleting Data: Data importer may only correct, delete or block personal data processed within the scope of the LCA and these Clauses in accordance with the instructions of the respective data exporter. Where data exporter so instructs data importer, data importer shall correct, delete or block data in the scope of these Clauses. Alternatively, data importer can provide data exporter with the necessary means to correct, delete or block personal data via the services agreed in the LCA. To the extent data exporter cannot correct, delete or block personal data in its use of the services, data importer shall comply with any such request from data exporter within a reasonable period of time.

		
	(c)
	Serious Interruption of Operations/Data Breaches: Data importer shall, without undue delay, inform data exporter in case of a serious interruption of operations, strong suspicion of breaches of personal data protection (but in any case including all suspicion which may lead to reporting obligations of data exporter under any applicable data protection laws in the jurisdictions in which the Service Recipients under this Local Country Agreement are located or the GDPR when it comes into effect), and any other severe irregularity in processing personal data under these Clauses/the LCA and shall also cooperate and support data exporter to the extent necessary to comply with the data breach information obligations applicable under the relevant EU-law and the respective implementing local data protection laws of the EU-Member States. This means in particular that if data importer becomes aware of any accidental, unauthorised or unlawful destruction, loss, alteration, or disclosure of, or access to the personal data that is processed by data importer in the course of providing the services under these Clauses/the LCA (or any other situation according to the preceding sentence) which is in breach of data importer’s security obligations under this Data Transfer Agreement (a "Security Breach"), it shall:

		
	(i)
	without undue delay (when the GDPR comes into effect, where feasible within 48 hours, if later, it shall be accompanied by reasons for the delay) inform data exporter of the Security Breach; 

		
	(ii)
	provide without undue delay (when the GDPR comes into effect, where feasible within 48 hours, if later, it shall be accompanied by reasons for the delay) data exporter with: (a) a detailed description of the Security Breach; (b) the affected systems (as well as periodic updates to this information and any other information data exporter may reasonably request relating to the Security Breach);

		
	(iii)
	take action immediately to investigate the Security Breach and to identify, prevent and mitigate the effects of the Security Breach and, with the prior written approval of data exporter, to carry out any recovery or other action necessary to remedy the Security Breach; and 

		
	(iv)
	not release or publish any filing, communication, notice, press release, or report concerning the Security Breach and mentioning the data exporter without data exporter's prior written approval (except where it is required to do so by applicable law).

		
	(d)
	Confidentiality and Data Secrecy: Data importer shall ensure that all personnel required to access/process the personal data are informed of the confidential nature of the personal data and comply with the obligations set out in this section 13.2 of the Master Service Agreement. In case data is processed in Germany, data importer shall ensure that any personnel entrusted with processing data exporter’s data have undertaken to comply with the principle of data secrecy in accordance with section 5 of the German Federal Data Protection Act and have been duly instructed on the protective regulations of the German Federal Data Protection Act. The undertaking to secrecy and confidentiality shall continue after the termination of the above-entitled activities.

		
	(e)
	Adequate Level of Data Protection: Data importer agrees and warrants that data importer and all its affiliates and/or all other third parties which act as subprocessors according to Clause 11 of these Clauses provide for or are subject to an adequate level of data protection according to Art. 25 and Art. 26 of the EU Data Protection Directive 95/46/EC (and the respective successor rules under the General Data Protection Regulation) when personal data is processed, e.g. currently by agreeing to the “EU Standard Contractual Clauses”.

		
	(f)
	Additional Provision on Disclosure: Data importer will not disclose personal data to law enforcement authorities or agencies unless required by law. Should a law enforcement authority or agency contact data importer with a demand for personal data, data importer will attempt to redirect the law enforcement authority or agency to request that data directly from data exporter. As part of this effort, data importer may provide data exporter’s basic contact information to the law enforcement authority or agency. If compelled to disclose personal data to a law enforcement authority or agency, data importer will promptly notify data exporter in advance of a disclosure unless legally prohibited to do so.

		
	(g)
	Additional Provision on Technical and Organisational Measures and Data Security: Data importer will not implement any changes to its security concept/technical and organisational measures that would lower the level of security compared to that described in Appendix 2 to these Clauses. In any case shall data importer notify data exporter with ninety (90) days prior notice of any planned material changes to the technical and organisational measures and/or its security concept as described in Appendix 2. Data exporter shall have the right to terminate these Clauses and the LCA upon thirty (30) calendar days prior written notice, if he – at its sole reasonable discretion – concluded that the modified technical and organisational measures/security concepts would no longer provide for adequate security standards/technical and organisational measures as required by the applicable data protection laws in order to process the personal data covered by the MSA/these Clauses.

		
	(h)
	Additional Provision regarding Audit Rights and Obligations of the Parties: In order to comply with its (statutory) obligations as a data controller, each data exporter needs to, prior to the commencement of processing, and in regular intervals thereafter, audit the technical and organisational measures taken by data importer, and shall document the resulting findings. For such purpose, the data importer agrees (without limiting the rights stipulated under Clause 5 f)) using auditors to verify its compliance with the security obligations under these Clauses and that of its subcontractors, including the security of the physical data centres from which data importer provides the services under this Data Transfer Agreement and the LCA. This audit: (a) will be performed at least annually; (b) will be performed by security professionals at data importer’s selection; and (c) will result in the generation of an audit report which will be provided to data exporter after this report was generated (upon data exporters written request) so that data exporter can reasonably verify data importer’s and its subcontractor’s compliance with the security obligations under these Clauses.

		
	(i)
	Additional Subprocessing Provision:  The data exporter agrees within the meaning of Clause 5 paragraph 8 and Clause 11 paragraph 1 of these Clauses that data importer may subcontract the processing operations under these Clauses to the subcontractors named in Appendix  3 to these Clauses subject to the further requirements set out in this Clause and Clause 11 of these Clauses. Such subcontractors shall only be permitted to obtain personal data covered by these Clauses to the extent required to deliver the services data importer has retained them to provide, and subcontractors shall be prohibited from using this personal data for any other purpose. Subcontractors shall only be allowed to store or process data in the territories/locations listed and for the services described in Appendix 3 to these Clauses.

		
	(j)
	Future Changes: If the European Commission lays down, or an applicable supervisory authority adopts, standard contractual clauses for the matters referred to in Article 28(3) and Article 28(4) of the General Data Protection Regulation pursuant to Article 28(7) or Article 28(8) of the General Data Protection Regulation (as appropriate) and data exporter notifies data importer that it wishes to incorporate any element of any such standard contractual clauses into this Annex, the parties will work together to mutually agree on the changes or to implement any additional measures that may be needed. The parties agree that changes affecting the provision of the services may result in price adjustments.

Clause 11
Sub-processing
		
	1.
	The data importer shall not subcontract any of its processing operations performed on behalf of the data exporter under the Clauses without the prior written consent of the data exporter. Where the data importer subcontracts its obligations under the Clauses, with the consent of the data exporter, it shall do so only by way of a written agreement with the sub-processor which imposes the same obligations on the sub-processor as are imposed on the data importer under the Clauses. Where the sub-processor fails to fulfil its data protection obligations under such written agreement the data importer shall remain fully liable to the data exporter for the performance of the sub-processor of the sub-processor’s obligations under such agreement.

		
	2.
	The prior written contract between the data importer and the sub-processor shall also provide for a third-party beneficiary clause as laid down in Clause 3 for cases where the data subject is not able to bring the claim for compensation referred to in paragraph 1 of Clause 6 against the data exporter or the data importer because they have factually disappeared or have ceased to exist in law or have become insolvent and no successor entity has assumed the entire legal obligations of the data exporter or data importer by contract or by operation of law. Such third-party liability of the sub-processor shall be limited to its own processing operations under the Clauses.

		
	3.
	The provisions relating to data protection aspects for sub-processing of the contract referred to in paragraph 1 shall be governed by the law of the Member State in which the data exporter is established.

		
	4.
	The data exporter shall keep a list of sub-processing agreements concluded under the Clauses and notified by the data importer pursuant to Clause 5(j), which shall be updated at least once a year. The list shall be available to the data exporter’s data protection supervisory authority.

Clause 12
Obligation after the termination of personal data-processing services
		
	1.
	The Parties agree that on the termination of the provision of data processing services, the data importer and the sub-processor shall, at the choice of the data exporter, return all the personal data transferred and the copies thereof to the data exporter or shall destroy all the personal data and certify to the data exporter that it has done so, unless legislation imposed upon the data importer prevents it from returning or destroying all or part of the personal data transferred. In that case, the data importer warrants that it will guarantee the confidentiality of the personal data transferred and will not actively process the personal data transferred anymore.

		
	2.
	The data importer and the sub-processor warrant that upon the request of the data exporter and/or of the supervisory authority, it will submit its data-processing facilities for an audit of the measures referred to in paragraph 1.

[Signatures on following page]

On behalf of the data exporter:
GRAPHIC PACKAGING INTERNATIONAL EUROPE NV
Name (written out in full):
Position:
Address: Fountain Plaza Belgicastraat 7 bus 5, 1930 Zaventem, Belgium
Other information necessary in order for the contract to be binding (if any):
Signature      
(stamp of organisation)
On behalf of the data importer:
DELL CORPORATION LTD.
Name (written out in full):
Position:
Address: Dell House, The Boulevard, Cain Road, Bracknell, Berkshire, RG12 1LF
Other information necessary in order for the contract to be binding (if any):
Signature      
(stamp of organisation)

Appendix 1

Data exporter
The data exporter is the Party which is a signatory to the LCA and its affiliates based in the EEA as specified as Service Recipients in Schedule 1.1 a) of the Master Service Agreement and which are the exporter of personal data.
Data importer
The data importer is a Party which is a signatory to the LCA and which is the recipient of personal data which is exported by the data exporter to it.
Data subjects
The personal data transferred concern the following categories of data subjects:
•Past, present and prospective employees, volunteers, interns and partners.
•Past, present and prospective clients.
•Past, present and potential advisors, consultants, suppliers, contractors, subcontractors and agents.
•Complainants, correspondents, visitors and enquirers.
•Beneficiaries, parents and guardians.
Categories of data
The personal data transferred concern the following categories of data:
•Contact details (which may include name, address, email address, telephone, fax, emergency contact details and associated local time zone information).
•Employment details (which may include company name, job title, grade, demographic, time recording and location data, nationality and export compliance status).
•IT systems and operational information (which may include voice, video and data recordings, user ID and password details, computer name, domain name, IP address, software and hardware inventory, security camera and software usage pattern tracking information, i.e. cookies, and information recorded for operational or training purposes).
•Data subjects' email content, online interactive and voice communications (such as blogs, chat, webcam and networking sessions) and transmission data which is available on an incidental basis for the provision of information technology consultancy, support and services (incidental access may include accessing the content of email communications and data relating to the sending, routing and delivery of emails).
•Details of goods or services provided to or for the benefit of data subjects.
•Financial and government and tax identifier details (e.g. credit, payment, bank details and NI or social security number).
Special categories of data

The personal data transferred concern the following special categories of data:
To the extent permitted by applicable law, the personal data may include information which reveals racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union opinions, memberships or activities, social security files, data concerning health (including physical or mental health or condition), sexual life and information regarding criminal offences or alleged offences and any related court proceedings, any information identified through use of whistle blowing hotlines and shall include special categories of data as defined in Article 8 of Directive 95/46/EC.
Processing operations
The personal data transferred will be subject to the following basic processing activities:
Any operation with regard to personal data irrespective of the means applied and procedures, in particular, the obtaining, collecting, recording, organising, storage, holding, use, amendment, adaptation, alteration, disclosure, dissemination or otherwise making available, aligning, combining, retrieval, consultation, archiving, transmission, blocking, erasing, or destruction of data, the operation and maintenance of systems, management and management reporting, financial reporting, risk management, compliance, legal and audit functions and shall include "processing" which shall have the meaning given to such term in Directive 95/46/EC.

Appendix 2 (to the Controller to Processor/Sub-Processor Model Clauses)
Technical and Organisational Security Measures 
This Appendix 2 sets out a description of the technical and organisational security measures implemented by the data importer in accordance with Clauses 4(d) and 5(c).
Data importer takes information security seriously and this approach is followed through in its processing and transfers of personal data.  This information security overview applies to data importer’s corporate controls for safeguarding personal data which is processed and transferred amongst the data importer’s group companies.  Data importer’s information security program enables the workforce to understand their responsibilities.  Some customer solutions may have alternate safeguards outlined in the applicable statement of work as agreed with each customer.
Security Practices
Data importer has implemented corporate information security practices and standards that are designed to safeguard data importer’s corporate environment and to address business objectives across the following areas: 
(1)     information security
(2)     system and asset management
(3)     development, and 
(4)     governance.  
These practices and standards are approved by the data importer’s executive management and are periodically reviewed and updated where necessary.  
Data importer shall maintain an appropriate data privacy and information security program, including policies and procedures for physical and logical access restrictions, data classification, access rights, credentialing programs, record retention, data privacy, information security and the treatment of personal data and sensitive personal data throughout its lifecycle.  Key policies should be reviewed at least annually.
Organizational Security
It is the responsibility of the individuals across the data importer’s organization to comply with these practices and standards.  To facilitate the corporate adherence to these practices and standards, data importer’s Information Security (“IS”) function is responsible for the following activities:
		
	1.
	Security strategy – the IS function drives data importer’s security direction.  The IS function works to ensure compliance with security related policies, standards and regulations, and to raise awareness and provide education to users.  The IS function also carries out risk assessments and risk management activities, and manages contract security requirements. 

		
	2.
	Security engineering – the IS function manages testing, design and implementation of security solutions to enable adoption of security controls across the environment.  

		
	3.
	Security operations – the IS function manages support of implemented security solutions, monitors and scans the environment and assets, and manages incident response.  

		
	4.
	Forensic investigations – the IS function works with Security Operations, Legal, Global Privacy Office and Human Resources to carry out investigations, including eDiscovery and eForensics.

		
	5.
	Security consulting and testing – the IS function works with software developers on developing security best practices, consults on application development and architecture for software projects, and carries out assurance testing.

Asset Classification and Control
Data importer’s practice is to track and manage key information and physical, software and logical assets.  Examples of the assets that data importer might track include: 
		
	•
	information assets, such as identified databases, disaster recovery plans, business continuity plans, data classification, archived information

		
	•
	software assets, such as identified applications and system software

		
	•
	physical assets, such as identified servers, desktops/laptops, backup/archival tapes, printers and communications equipment.

The assets are classified based on business criticality to determine confidentiality requirements.  Industry guidance for handling personal data provides the framework for technical, organizational and physical safeguards.  These safeguards may include controls such as access management, encryption, logging and monitoring, and data destruction.
Employee Screening, Training and Security
		
	1.
	Screening/background checks:  Where reasonably practicable and appropriate, as part of the employment/recruitment process, data importer shall perform screening/background checks on employees (which shall vary from country to country based on local laws and regulations), where such employees will have access to data importer’s networks, systems or facilities.

		
	2.
	Identification:  Data importer shall require all employees to provide proof of identification and any additional documentation that may be required based on the country of hire or if required by other data importer entities or customers for whom the employee is providing services.

		
	3.
	Training:  Data importer’s annual compliance training program includes a requirement for employees to complete a data protection and information security awareness course and pass an assessment at the end of the course.  The security awareness course may also provide materials specific to certain job functions.  

		
	4.
	Confidentiality:  Data importer shall ensure its employees are legally bound to protect and maintain the confidentiality of any personal data they handle pursuant to standard agreements.

Physical Access Controls and Environmental Security
		
	1.
	Physical Security Program:  Data importer shall use a number of technological and operational approaches in its physical security program to mitigate security risks to the extent reasonably practicable.  Data importer’s security team works closely with each site to determine appropriate measures are in place to prevent unauthorized persons from gaining access to systems within which personal data is processed and continually monitor any changes to the physical infrastructure, business and known threats.  They also monitor best practice measures used by others in the industry and carefully select approaches that meet both uniqueness in business practice and expectations of data importer.  Data importer balances its approach towards security by considering elements of control that include architecture, operations and systems.  

		
	2.
	Physical Access controls:  Physical access controls/security measures at data importer’s facilities/premises are designed to meet the following requirements:

		
	(a)
	access to data importer’s buildings, facilities and other physical premises shall be controlled and based upon business necessity, sensitivity of assets and the individual’s role and relationship to the data importer.  Only personnel associated with data importer are provided access to data importer’s facilities and physical resources in a manner consistent with their role and responsibilities in the organization;

		
	(b)
	relevant data importer facilities are secured by an access control system.  Access to such facilities is granted with an activated card only;

		
	(c)
	all persons requiring access to facilities and/or resources are issued with appropriate and unique physical access credentials (e.g. a badge or keycard assigned to one individual) by the IS function.  Individuals issued with unique physical access credentials are instructed not to allow or enable other individuals to access the data importer’s facilities or resources using their unique credentials (e.g. no “tailgating”).  Temporary (up to 14 days) credentials may be issued to individuals who do not have active identities where this is necessary (i) for access to a specific facility and (ii) for valid business needs.  Unique credentials are non-transferable and if an individual cannot produce their credentials upon request they may be denied entry to data importer’s facilities or escorted off the premises.  At staffed entrances, individuals are required to present a valid photo identification or valid credentials to the security representative upon entering.  Individuals who have lost or misplaced their credentials or other identification are required to enter through a staffed entrance and be issued a temporary badge by a security representative;

		
	(d)
	employees are regularly trained and reminded to always carry their credentials, store their laptops, portable devices and documents in a secure location (especially while traveling) and log out or shut down their computers when away from their desk;

		
	(e)
	visitors who require access to data importer’s facilities must enter through a staffed and/or main facility entrance.  Visitors must register their date and time of arrival, time of leaving the building and the name of the person they are visiting.  Visitors must produce a current, government issued form of identification to validate their identity.  To prevent access to, or disclosure of, company proprietary information visitors are not allowed un-escorted access to restricted or controlled areas;

		
	(f)
	select data importer facilities use CCTV monitoring, security guards and other physical measures where appropriate and legally permitted;

		
	(g)
	locked shred bins are provided on most sites to enable secure destruction of confidential information/personal data;

		
	(h)
	for data importer’s major data centres, security guards, UPS and generators, and change control standards are available;

		
	(i)
	for software development and infrastructure deployment projects, the IS function uses a risk evaluation process and a data classification program to manage risk arising from such activities.

Change Management
The IT organization manages changes to the corporate infrastructure, systems and applications through a centralized change management program, which may include testing, business impact analysis and management approval where appropriate.  All relevant application and systems developments adhere to an approved change management process.  
Security Incidents and Response Plan
		
	1.
	Security incident response plan:  Data importer maintains a security incident response policy and related plan and procedures which address the measures that data importer will take in the event of loss of control, theft, unauthorized disclosure, unauthorized access, or unauthorized acquisition of personal data.  These measures may include incident analysis, containment, response, remediation, reporting and the return to normal operations.  

		
	2.
	Response controls:  Controls are in place to protect against, and support the detection of, malicious use of assets and malicious software and to report potential incidents to the data importer’s IS function or Service Desk for appropriate action.  Controls may include, but are not limited to: information security policies and standards; restricted access; designated development and test environments; virus detection on servers, desktop and notebooks; virus email attachment scanning; system compliance scans; intrusion prevention monitoring and response; firewall rules; logging and alerting on key events; information handling procedures based on data type; e-commerce application and network security; and system and application vulnerability scanning.  Additional controls may be implemented based on risk.  

Data Transmission Control and Encryption
Data importer shall, to the extent it has control over any electronic transmission or transfer of personal data, take all reasonable steps to ensure that such transmission or transfer cannot be read, copied, altered or removed without proper authority during its transmission or transfer.  In particular, data importer shall:
		
	1. 
	implement industry-standard encryption practices in its transmission of personal data.  Industry-standard encryption methods used by data importer includes Secure Sockets Layer (SSL), Transport Layer Security (TLS), a secure shell program such as SSH, and/or Internet Protocol Security (IPSec);

		
	2.
	if technically feasible, encrypt all personal data, including, in particular any sensitive personal data or confidential information, when transmitting or transferring that data over any public network, or over any network not owned and maintained by data importer.  The data importer’s policy recognizes that encryption is ineffective unless the encryption key is inaccessible to unauthorized individuals and instructs personnel never to provide an encryption key via the same channel as the encrypted document;

		
	3.
	for Internet-facing applications that may handle sensitive personal data and/or provide real-time integration with systems on a network that contains such information (including data importer’s core network), a Web Application Firewall (WAF) may be used to provide an additional layer of input checking and attack mitigation. The WAF will be configured to mitigate potential vulnerabilities such as injection attacks, buffer overflows, cookie manipulation and other common attack methods.

System Access Controls
Access to data importer’s systems is restricted to authorized users.  Access is granted based on formal procedures designed to ensure appropriate approvals are granted so as to prevent access from unauthorised individuals. Such procedures include:
		
	1.
	admission controls (i.e. measures to prevent unauthorized persons from using data processing systems):

		
	(a)
	access is provided based on segregation of duties and least privileges in order to reduce the risk of misuse, intention or otherwise;  

		
	(b)
	access to IT systems will be granted only when a user is registered under a valid username and password;

		
	(c)
	data importer has a password policy in place which requires strong passwords for user login to issued laptops, prohibits the sharing of passwords, prohibits the use of passwords that are also used for non-work functions, and advises users on what to do in the event their password or other login credentials are lost, stolen or compromised;

		
	(d)
	mandatory password changes on a regular basis;

		
	(e)
	automatic computer lock, renewed access to the PC only after new registration with a valid username and password;

		
	(f)
	data and user classification determines the type of authentication that must be used by each system;

		
	(g)
	remote access and wireless computing capabilities are restricted and require that both user and system safeguards are in place as well as user authentication.

		
	2.
	access controls (i.e. measures to prevent unauthorised access to systems):

		
	(a)
	access authorization is issued in respect of the specific area of work the individual is assigned to (i.e. work role); 

		
	(b)
	adjustment of access authorizations in case of changes to the working area, or in case an employee’s employment is terminated for any reason;

		
	(c)
	granting, removing and reviewing administrator privileges with the appropriate additional controls and only as needed to support the system(s) in question;

		
	(d)
	event logs from key devices and systems are centrally collected and reported on an exceptions basis to enable incident response and forensic investigations. 

Data Access Control
Data importer applies the controls set out below regarding the access and use of personal data:
		
	1.
	personnel are instructed to only use the minimum amount of personal data necessary in order to achieve the data importer’s relevant business purposes

		
	2.
	personnel are instructed not to read, copy, modify or remove personal data unless necessary in order to carry out their work duties;

		
	3.
	third party use of personal data is governed through contractual terms and conditions between the third party and data importer which impose limits on the third party’s use of personal data and restricts such use to what is necessary for the third party to provide services;

Separation control
Where legally required, data importer will ensure that personal data collected for different purposes can be processed separately.  Data importer shall also ensure there is separation between test and production systems.
Availability Control
Data importer protects personal data against accidental destruction or loss by following these controls:
		
	1.
	personal data is retained in accordance with customer contract or, in its absence, data importer’s record management policy and practices, as well as legal retention requirements;

		
	2.
	hardcopy personal data is disposed of in a secure disposal bin or a crosscut shredder such that the information is no longer decipherable;

		
	3.
	electronic personal data is given to data importer’s IT Asset Management team for proper disposal;

		
	4.
	appropriate technical measures are in place, including (without limitation): anti-virus software is installed on all systems; network protection is provided via firewall; network segmentation; user of content filter/proxies; interruption-free power supply; regular generation of back-ups; hard disk mirroring where required; fire safety system; water protection systems where appropriate; emergency plans; and air-conditioned server rooms.

Data Input Control
Data importer has, where appropriate, measures designed to check whether and by whom personal data have been input into data processing systems, or whether such data has been modified or removed.  Access to relevant applications is recorded.
System Development and Maintenance
Publicly released third party vulnerabilities are reviewed for applicability in the data importer environment.  Based on risk to data importer’s business and customers, there are pre-determined timeframes for remediation.  In addition, vulnerability scanning and assessments are performed on new and key applications and the infrastructure based on risk.  Code reviews and scanners are used in the development environment prior to production to proactively detect coding vulnerabilities based on risk.  These processes enable proactive identification of vulnerabilities as well as compliance.
Compliance
The information security, legal, privacy and compliance departments work to identify regional laws and regulations that may be applicable to data importer.  These requirements cover areas such as, intellectual property of the data importer and its customers, software licenses, protection of employee and customer personal information, data protection and data handling procedures, trans-border data transmission, financial and operational procedures, regulatory export controls around technology, and forensic requirements.
Mechanisms such as the information security program, the executive privacy council, internal and external audits/assessments, internal and external legal counsel consultation, internal controls assessment, internal penetration testing and vulnerability assessments, contract management, security awareness, security consulting, policy exception reviews and risk management combine to drive compliance with these requirements.

ANNEX 2 to the LOCAL COUNTRY AGREEMENT
Form of Invoice
[Attached]

12

Source: [{"source": "alea-institute/alea-institute/kl3m-data-edgar-agreements/train-00270-of-00352.parquet"}, [{"source": "alea-institute/alea-institute/kl3m-data-edgar-agreements/train-00270-of-00352.parquet"}]]