Archived Version

General Terms and Conditions (“GTC”)

Version: April 2026

These GTC shall govern the provision by Cognism and receipt by Customer of Cognism products and services as set out in the relevant Order. The Order, any applicable special terms or additional terms the parties may agree to in a specific Order (“Special Terms”) and these GTC together constitute the agreement of the parties (collectively, the “Agreement”). In the event of any conflict between the Order terms and the GTC, the Order shall prevail. Any general terms and conditions which Customer purports to introduce by means of a purchase order or similar system shall not apply. Capitalized terms used have their meanings set out under Section 11 (Definitions).

1. License to use Cognism Services

1.1 License grant. Subject to the payment of all applicable Subscription Fees and for the applicable Subscription Term, Cognism hereby grants Customer a non-exclusive, non-transferable, non-sub-licensable, revocable license in accordance with the terms of this Agreement to access Cognism online proprietary platform to use the Services, subject to the terms and conditions of this Agreement. The Services may include information (the “Profile Data”), access to and/or use of software, tool, feature or other technology (the “Cognism Technology”). Customer may use the Services solely for its internal business purposes. Customer is not permitted to sublicense, resell, transfer, offer for sale, disclose, distribute or make available any of the Profile Data or any part of the Services to any third party without Cognism’s prior written consent.

1.2 Restrictions. Unless expressly permitted under this Agreement or applicable law, Customer shall not, and shall ensure that its End Users shall not: (a) reverse engineer, decompile, or disassemble the source code of the Services or any of the Cognism Technology, or attempt to do so; (b) reproduce, modify, create, or prepare derivative works of any of the Services or related Documentation; (c) work around technical limitations in a Service or restrictions in the related Documentation; (d) attempt to gain unauthorized access to the Services, other accounts, computer systems, or networks connected to the Services; (e) alter, destroy or otherwise remove any proprietary notices or labels from the Services; (f) disclose the results of any of the Cognism Technology or program benchmark tests to any third parties without Cognism’s prior written consent; (g) make the Services, including any Profile Data therein, publicly available for bots or other entities to crawl; or (h) use the Services in any manner that violates applicable laws or regulations. Any breach of this Section 1.2 by Customer or its End Users shall be deemed an irremediable material breach of the Agreement.

1.3 End Users. Customer may assign each Subscription License to one individual End User for use or access on any number of devices, including to the Customer’s Affiliates’ employees or contractors, subject to the number of Subscription Licenses purchased under the relevant Order. Throughout the Subscription Term, Customer may submit a request to Cognism to reassign a Subscription License to another End User (which Cognism shall approve at its discretion). Each End User will be provided with a unique username and password. Such usernames and passwords shall not be shared and shall not under any circumstances be used by anyone who is not an End User. Customer controls access to and use of the Services by End Users and is solely responsible for ensuring that all End Users comply with the terms of the Agreement.

2. Services

2.1 Order. Each Order will set out the applicable Subscription Fees, the Subscription Term, the number of Subscription Licenses and the scope of the Services. Unless otherwise expressly set out in the Order, order forms expire unless accepted prior to their stated expiration date. Expansions of or additional Services may be mutually agreed in a separate Order and will run co-term with the Order they add to.

2.2 Affiliates. Customer’s Affiliate(s) may purchase Services under these GTCs if such Affiliate directly signing a separate Order with Cognism, and, such Affiliate agrees to be bound by the terms of these GTCs as if it were an original party hereto. Where such Customer Affiliate signs an Order with Cognism, all references to “Customer” in the Agreement shall be deemed to refer to such Customer Affiliate.

2.3 Compliance with laws. Customer’s use of the Services must not breach any applicable laws, including, but not limited to, copyright or trademark laws, data protection and privacy laws, export control laws and regulations, including ones specific to its jurisdiction.

2.4 Artificial Intelligence. Services may contain certain computational features, including artificial intelligence (“AI”) search engine, machine learning or similar functionality (“AI Features”), which are trained in Cognism’s local and offline environment for product and research development purposes, to improve and personalise user experiences. Cognism acknowledges and agrees that Customer Data provided by Customer as part of the Services is confidential. Cognism is committed to safeguarding Customer Data and respecting its users’ privacy. Customer Data will not be used to train public AI. In the event Customer set up data import, Cognism may ingest Customer Data for data validation purposes unless Customer decides to opt out from that functionality.

3. Data Ownership

3.1 Intellectual Property and Reservation of rights. Cognism retains all rights, title and interest including all intellectual property rights and database rights, in and to the Services, the Cognism Technology, Profile Data (as a compilation, database and enriched dataset), Usage Data (as defined below), and any aggregated or anonymised analytics, statistics or insights generated by or through the operation of the Services. Cognism also retains all rights, title and interest in any AI Features, and any models, outputs, results, insights or improvements generated by or through the Services or AI Features. Customer acknowledges and agrees that it does not acquire any ownership rights in the Services by virtue of this Agreement. Cognism reserves all rights not expressly granted in this Agreement, and no rights are granted or implied by waiver or estoppel. Cognism does not claim ownership of Customer Data itself.

3.2 Third-Party Integrations. At any time during the Term, the Customer may request that the Services are connected to or interact with one or several of the Customer’s third-party service providers, for example, CRM platforms or email services (“Integration Third Parties”) solely for purposes permitted by the Services (“Integrations”). Customer is solely responsible for maintaining any agreement with any Integration Third-Party including for any credits, allowances, API calls, fees and other costs therein. To the extent Customer and/or End Users use the Services to transmit any Customer Data through the Integrations, Customer hereby instructs and authorizes Cognism to provide and/or receive such Customer Data to or from such Integration Third-Party. Integration Third Parties are not controlled by and are not agents of Cognism and Cognism takes no responsibility for their services, compliance, accuracy, actions or omissions or for their maintenance or treatment of Customer Data and Customer acknowledges and agrees that any Customer Data shared via Integrations is processed under Customer’s own contractual arrangements with such Integration Third Parties. Cognism will not be liable for and expressly disclaims all liability for any claim, damage or loss caused hereunder and is not responsible for any disclosure, modification or deletion of Customer Data resulting from access by an Integration Third-Party, to the extent permitted by applicable law.

3.3 Usage Data. Cognism may collect and process information regarding the configuration, performance, security, and Customer’s access to and use of the Services (“Usage Data”) for its internal business purposes, including to develop, improve, support, secure and operate services, evaluating how End Users use the Services and to fulfil legal or regulatory obligations. Usage Data does not include Customer Data. Where required by applicable law, Usage Data shall be processed in accordance with the Data Protection Addendum. Any reporting, analytics or other outputs derived from Usage Data will be aggregated and/or anonymised and will not identify the Customer or its End Users.

3.4 DNC Disclaimer. Cognism verifies on a regular basis a select list of Do Not Call (“DNC”) registries and flags as part of the Services all contact data on such registries. Customers have the option to toggle visualization of such contact data on/off in their account. Customer shall be solely responsible for using contact data flagged as DNC. Cognism will not be liable for and expressly disclaims all liability for any claim, damage or loss caused hereunder resulting from Customer’s reliance on the accuracy of or access to contact data on any DNC list.

4. Data Protection

4.1 Data Processing. Each Party will process Personal Data in connection with this Agreement and will comply with the terms set out in the Data Protection Addendum under Appendix 1 herein (“DPA”).

4.2 Customer and Cognism will implement appropriate technical and organisational measures to protect Personal Data against any misuse, and each party will comply with data protection law and regulation applicable to their respective business activities, including the processing of Personal Data in the context of using or providing the Services.

4.3 Opt-Out. Cognism shall make available a list of individuals who have requested to be excluded from Cognism’s database (the “Opt-Out List”). Customer hereby agrees to access and review the Opt-Out List on a regular basis, and in no event less than once every thirty (30) calendar days. Customer agrees that it shall, without undue delay, permanently delete and cease all processing of any business contact data relating to individuals identified on the Opt-Out List, unless Customer has established and can demonstrate some other independent lawful basis for its continued retention and processing of such data, and that such continued retention and processing will be in compliance with Applicable Data Privacy Laws.

5. Pricing and payment

5.1 Fees. Customer shall pay the subscription fees set out in the Order (“Subscription Fees”) according to the terms of the applicable Order. Payment obligations are non-cancellable, and Subscription Fees are non-refundable, unless this Agreement or an applicable Order is terminated pursuant to Sections 10.2 (a) or 10.3, in which case any prepaid, unused Subscription Fees will be refunded. Customer is responsible for providing Cognism with their up-to-date complete and accurate billing and contact information. Customer is responsible for all bank charges, transfer fees, and other payment-related costs associated with remitting fees to Cognism. All payments must be received by Cognism in full and free of any deductions, with the Customer bearing any and all fees imposed by its bank, intermediaries, or payment providers.

5.2 Late payment. If Customer fails to pay the Subscription Fees by the due date, Cognism has the right to charge the lower of 1.5% monthly interest on past due amounts or the maximum allowed under applicable law. Cognism also has the right to: (a) subject to a 10-day prior notice: (i) terminate the applicable Order or (ii) turn off access; and (b) take any other action available to it under applicable law. Subscription Fees continue to accrue while access is turned off.

5.3 Taxes. Customer is solely responsible for all taxes, fees, duties and governmental assessments that are imposed or become due in connection with this Agreement. Unless otherwise specified in the Order, all fees, rates, and estimates exclude such taxes, fees, and governmental assessments.

5.4 Renewal Uplift. Cognism reserves the right to increase the Subscription Fees upon any Renewal Term, provided that such increase shall not exceed ten percent (10%).

5.5 Purchase Order. If Customer uses a purchase order or similar system (“PO”), it must issue a PO upon execution of the Agreement, any renewal, and any future expansion. Any delay or failure in issuing a PO will not relieve Customer of its payment obligations under the Agreement.

6. Warranties

6.1 Warranties and remedies. Cognism warrants that it shall provide the Services with reasonable care and skill in accordance with applicable industry standards during the Subscription Term. If the Services materially fail to comply with this warranty and Customer promptly notifies Cognism in writing with reasonable supporting detail, Cognism shall use commercially reasonable efforts to investigate the notified issue and, where reasonably practicable, take steps to address it within the operation of the Services. Where such material failure persists and Cognism has not remedied it within a reasonable period, Customer may terminate the affected Subscription Term on written notice, and Cognism shall refund any pre‑paid Subscription Fees attributable to the unused portion of that Subscription Term. This clause sets out Customer’s sole and exclusive remedies for breach of this warranty. Customer waives any warranty claims not made during the Subscription Term.

6.2 Exclusions. This warranty shall not apply to non-conformities, errors, or problems (a) caused by acts within the control of Customer or any End Users; or (b) arising from: (i) Customer’s negligence or improper use of the Service, (ii) unauthorised modifications made to the Service by or on behalf of Customer, (iii) use of the Services in an unsupported operating environment or manner, or (iv) interoperability issues arising from devices or equipment or browsers used by Customer to access the Service or that arises from Customer’s or any third party’s software or systems (including Integration Third Parties). This warranty does not apply to Previews.

6.3 Disclaimer. Except for the limited warranties above and subject to applicable law, Cognism makes no additional warranty, condition, representation, undertaking or guaranty of any kind to Customer, and Cognism specifically disclaims any and all express, implied or statutory warranties, conditions, representations, undertakings and guaranties, including, without limitation any with respect to quality, title, non-infringement, merchantability, or fitness for a particular purpose.

7. Infringement claims

7.1 Indemnification process. The parties will defend each other against claims described in this Section 7 and will pay the amount of any resulting adverse final judgment or approved settlement, provided that: (a) the party benefiting from the indemnity (“Indemnified Party”) shall give written notice to the party giving the indemnity (“Indemnifying Party”) of any claims or proceedings immediately following receipt of them, such notice to specify in sufficient details the nature of the claim; (b) the Indemnified Party shall make no admission of liability, agreement, compromise or attempt to settle a claim, and hereby give the Indemnifying Party the sole authority to defend or settle the claims or proceedings at the Indemnifying Party’s cost and expense; and (c) the Indemnified Party shall give the Indemnifying Party all reasonable assistance in connection with the claims or proceedings, at the Indemnifying Party’s cost and expense.

7.2 Cognism obligations. Cognism will defend and indemnify Customer against any third-party claim that a Service made available by Cognism (but excluding any Previews) directly infringes a patent, copyright, trademark, or other proprietary right of a third party (“Infringement Claim”). Cognism shall not be liable for any Infringement Claim which is: (a) caused by Customer’s, or any of its End Users’, use of the Services in combination with software not supplied or approved by Cognism; or (b) resulting from modifications of the Services by or on behalf of Customer; or (c) based on use of any version of the Services other than the latest version supplied by Cognism, if such claim could have been avoided by the use of such supplied version; or (d) arises as a result of Customer’s, or any of its End Users’, use of the Services in breach of this Agreement or any applicable laws.

7.3 Additional remedies. If an Infringement Claim is upheld or is reasonably believed by Customer to be upheld, or if any injunction or restraining order is issued, Cognism may, at its option, either (a) obtain the right for Customer to continue to use the applicable Services; (b) modify or replace the Service with a functional equivalent or (c) in the event that Cognism considers, acting reasonably that neither (a) or (b) are commercially reasonable options, terminate the relevant Order(s) and refund any license fees, including amounts paid in advance for any usage period after the effective termination date of such Order(s).

7.4 Customer obligations. Customer will defend and indemnify Cognism and its Affiliates against any third-party claim that: (a) any Customer Data directly infringes a or misappropriates any intellectual property or other rights of a third party; (b) Customer’s or any End User’s use of any Service in violation of any applicable laws or in breach of the terms of this Agreement; or c) any use of the Services or Profile Data by Customer or its End Users in combination with data, software or systems in a manner that materially contributes to the third-party claim and would not have arisen but for such combination.

7.5 This Section 7 describes the parties’ sole remedies and entire liability for such claims, subject to the limitations set out in Section 8 (Limitation of liability).

8. Limitation of liability

8.1 General limitation. Each party’s maximum aggregate liability to the other in contract, tort, negligence, for breach of statutory duty or otherwise arising out of or in connection with this Agreement is limited to direct damages finally awarded in an amount not to exceed the amounts paid or payable by Customer hereunder during the twelve (12) months prior to the date on which such claim or cause of action arose.

8.2 Exclusions. In no event will either party be liable for indirect, incidental, special, punitive, or consequential damages, or loss of use, loss of profits, or interruption of business; however caused and, whether in contract, tort or under any other theory of liability, whether or not the party has been advised of the possibility of such damage.

8.3 Exceptions. To the extent permitted under applicable law, neither party shall limit or exclude its liability for: (a) bodily injury and death caused by the negligence of either party; (b) either party’s indemnity obligations given under Section 7 (Infringement Claims); (c) either party’s breach of Section 9 (Confidentiality); or (d) either party’s breach of the other party’s intellectual property rights.

9. Confidentiality

9.1 Confidential Information. Confidential Information does not include information that (a) becomes publicly available without a breach of a confidentiality obligation; (b) was received lawfully from another source without a confidentiality obligation; (c) is independently developed without use or reference of the disclosing party’s Confidential Information; (d) is Personal Data, which are subject to Section 4 (Data Protection); or (e) is Feedback.

9.2 Protection of Confidential Information. Either party who receives Confidential Information (“Receiving Party”) will take reasonable steps to protect the Confidential Information of the other party (“Disclosing Party”). The Receiving Party will only use the Disclosing Party’s Confidential Information as part of the parties’ business relationship. Neither party will disclose Confidential Information to third parties. The Receiving Party may only share Confidential Information with its Representatives on a need-to-know basis, under non-disclosure obligations at least as protective as the terms of this Section. Each party remains responsible for the use of Confidential Information by its Representatives. A party must promptly notify the other party if it discovers any unauthorised use or disclosure.

9.3 Disclosure required by law. Notwithstanding anything to the contrary herein, the Receiving Party may disclose the Disclosing Party’s Confidential Information in order to comply with applicable law and/or an order from a court or other governmental body of competent jurisdiction, and, in connection with compliance with such an order only, if the Receiving Party: (a) to the extent permitted by law, gives the Disclosing Party prior written notice to such disclosure if the time between that order and such disclosure reasonably permits or, if time does not permit, gives the Disclosing Party written notice of such disclosure promptly after complying with that order and (b) fully cooperates with the Disclosing Party, at the Disclosing Party's cost and expense, in seeking a protective order, or confidential treatment, or taking other measures to oppose or limit such disclosure. Each party must not release any more of the other party's Confidential Information than is, in the opinion of its counsel, reasonably necessary to comply with an applicable order.

9.4 Remedies. If the Receiving Party discloses or uses (or threatens to disclose or use) any Confidential Information in breach of this Section 9, the Disclosing Party shall have the right, in addition to any other remedies available to it, to seek injunctive relief to enjoin such acts, it being specifically acknowledged by the Parties that any other available remedies are inadequate.

9.5 Duration of confidentiality obligation. These confidentiality obligations apply: (a) for Customer Data, until it is deleted from the Services; and (b) for all other Confidential Information, for a period of five years after the Receiving Party receives the Confidential Information.

10. Term and termination

10.1 Term. This Agreement will commence on the last signature date of the initial Order entered into between the parties (“Effective Date”) and will continue in full force and effect until (a) terminated by either party pursuant to the termination rights set forth in this Section 10, or (b) the twelve (12) month anniversary of the termination of the last effective Order Form. Except as otherwise specified in an Order, an Order will take effect from the Effective Date, will remain in force for the Subscription Term (“Initial Term”) and shall automatically renew for a period equal to the length of the Initial Term or one year, whichever is longer (each a “Renewal Term”), unless and until either party gives the other written notice of non-renewal at least sixty (60) days prior to the end of the then-current Subscription Term. Notwithstanding the foregoing,

10.2 Termination for cause. Without limiting other remedies available to it under applicable law, either party may terminate this Agreement and/or any Order immediately by providing written notice to the other party in the event the other party (a) commits any material breach of its duties and fails to remedy that breach within 30 days of receiving written notice of that breach, unless the breach is incapable of remedy in which case the Agreement or the Order may be terminated by written notice immediately; or (b) passes a resolution for its winding up, or a court of competent jurisdiction makes an order for its winding up or dissolution, or an administration order is made in relation to the other party, or a receiver is appointed over, or the other party makes an arrangement or composition with its creditors generally or makes an application to a court of competent jurisdiction for protection from its creditors generally, or the other party ceases to trade.

10.3 Termination for regulatory reasons. Cognism may modify, discontinue, or terminate a Service in any country or jurisdiction where there is any current or future government regulation, obligation, or other requirement, that (a) is not generally applicable to businesses operating there; (b) presents a hardship for Cognism to continue offering the Service without modification; or (c) causes Cognism to believe these terms or the Service may conflict with any such regulation, obligation, or requirement. If Cognism terminates a subscription for regulatory reasons, Customer will receive, as its sole remedy, a reimbursement for any prepaid, unused Subscription Fees.

10.4 Use of Other Services and Exports. Nothing in this Agreement limits Customer’s right to switch to other services of a similar type or to use other providers in parallel. In the event Customer wishes to stop using the Service to switch to another provider, Customer shall provide Cognism with at least sixty (60) days prior written notice. Cognism does not apply any switching charges, however, all Subscription Fees due under the Subscription Term remain payable and all Subscription Fees paid for the Service are non-refundable as set out in Section 5.1. Upon expiry or termination of the applicable Subscription Term, and subject to payment of all Subscription Fees, Cognism shall provide reasonable assistance, in accordance with its standard processes, to facilitate such transition. Any assistance shall be limited in scope, duration and effort and shall not require Cognism to disclose proprietary information, trade secrets, or information relating to other service providers.

10.5 Effects of Termination. Any termination of this Agreement and/or Order shall be without prejudice to any other rights or remedies a party may be entitled to hereunder or at law. The termination of an Order shall not terminate this Agreement, but the termination of this Agreement shall operate to terminate all active Orders. Upon the effective date of termination of the then-current Order, Customer shall cease all use of the Services and all licenses granted under this Agreement shall terminate immediately. Subject to Customer’s continued compliance with applicable law, Customer may continue to use Profile Data obtained from Cognism pursuant to the Services and stored on Customer’s systems before the expiration of the then-current Subscription Term. Customer understands and acknowledges that any use of such Profile Data after the termination of this Agreement will be made at its own risk and responsibility, and that Cognism will not provide any Services with regards to such Profile Data. Customer shall continue to comply with all of its obligations under applicable data privacy and marketing laws and regulations when using such Profile Data, and shall be solely and fully liable for its use. Except as necessary to comply with applicable law, each Party will promptly return to the other or destroy, as requested by the other party, all of the other party’s applicable Confidential Information within its possession or control and will certify in writing, if requested, that it has complied with its obligations to return or destroy all such Confidential Information. Any Confidential Information retained pursuant to applicable law shall remain subject to the confidentiality obligations set out in Section 9.

11. Miscellaneous

11.1 Independent contractors. The parties are independent contractors. Customer and Cognism may develop products independently, provided either party does not breach their obligations of confidentiality under this Agreement nor otherwise impedes, affects or diminishes any of the other party’s Confidential Information.

11.2 Amendments. Except for Cognism’s modification or update of the Documentation or the Subscription Service, or any policies as necessary to comply with applicable law, rules, regulations, no modification of this Agreement is legally binding against the other Party unless in writing and signed or electronically accepted by both Parties, except where Customer has agreed the GTC without negotiation, in which case the then-current version of the GTC will apply.

11.3 Assignment. Cognism may, without consent from Customer, assign this Agreement to an Affiliate but only to the extent that such assignment would not result in an impairment of Customer’s rights under this Agreement. Any other assignment of this Agreement must be approved by the other party in writing. Such notification to Cognism shall be made to the account manager at Cognism with a mandatory copy to legal@cognism.com. Any attempted assignment without required approval will be void.

11.4 Compliance with trade laws. The parties acknowledge that the Services may be subject to trade control, export control and economic sanctions laws and regulations applicable in the United States, the United Kingdom, the European Union and other jurisdictions (“Trade Laws”). Each party shall comply with all applicable Trade Laws in connection with this Agreement. Customer shall not take any action that causes Cognism to breach applicable Trade Laws, including by permitting access to or use of the Services in any sanctioned or embargoed country or region. Customer shall promptly notify Cognism if it becomes aware of any actual or suspected breach of Trade Laws in connection with this Agreement. Cognism may suspend or terminate the Agreement to the extent it reasonably determines that continued performance would result in, or risk, a breach of applicable Trade Laws or the imposition of sanctions.

11.5 Anti-Bribery and Corruption. Each party warrants that it has not and will not, in connection with this Agreement, offer, give, request or accept any bribe, kickback or other improper payment or inducement in violation of applicable anti-bribery and anti-corruption laws. Each party shall promptly notify the other if it becomes aware of any breach of this clause.

11.6 Severability. If any part of this Agreement is held to be unenforceable, the rest of the Agreement will remain in full force and effect.

11.7 Waiver. Failure to enforce any provision of this Agreement will not constitute a waiver. Any waiver must be in writing and signed by the waiving party. The parties acknowledge that in entering into this Agreement, they do not do so on the basis of, and do not rely on, any representations, warranties or other provisions except as expressly provided herein and all conditions, warranties and other terms implied by statute or common law are hereby excluded to the fullest extent permitted by law.

11.8 No third-party beneficiaries. This Agreement does not create any third-party beneficiary rights except as expressly provided by its terms.

11.9 Survival. All provisions survive termination of this Agreement except those requiring performance only during the term of the Agreement.

11.10 Notices. Notices to Cognism may be submitted via email to the Account Management team at connect@cognism.com, with a copy to legal@cognism.com. If Customer wishes to formally service notice on Cognism, it must do so in writing to Cognism’s registered agent:

Cognism Limited, C/O Worldwide Corporate Advisors, St Clements House, 27 Clements Lane, London EC4N 7AE, UK

Notices will be treated as delivered on the date received at the address, date shown on the return receipt, email transmission date, or date on the courier confirmation of delivery. Notices to Customer will be sent to the individual at the address Customer identifies on its account as its contact for notices. Customer shall ensure its contact for notices is up to date during each renewal. Cognism may send notices and other information to Customer by email or other electronic form.

11.11 Settlement in Good-Faith. The parties shall attempt to settle disputes arising out of or in connection with the Agreement by good-faith negotiations between senior management of each party, to commence within two (2) weeks from the date of a written request from an affected party. If negotiations do not resolve the dispute within one (1) month from request, the parties will attempt to resolve the matter in good faith through an alternative dispute resolution (ADR) procedure as recommended to the Parties by the Centre for Effective Dispute Resolution. If the matter has not been resolved by an ADR procedure within 30 days of initiation of such procedure, or if either party will not participate in an ADR procedure, a party may proceed as set forth in Section 11.12. Commencement of any dispute resolution process shall not relieve either party from its continued duties and obligations under the Agreement, including but not limited to any payments due and payable.

11.12 Applicable law and venue. If the Order lists Cognism, Inc. as a party, this Agreement will be governed by and construed in accordance with the laws of the Commonwealth of Massachusetts without regard to its conflict of law principles and federal laws of the United States. Any legal action or proceeding will be brought exclusively in the federal or state courts located in Boston, Massachusetts. The parties to this Agreement consent to personal jurisdiction and venue there. If the Order lists Cognism Limited or any other Affiliates of Cognism as a party, this Agreement will be governed by the laws of England and Wales. Any legal action or proceeding will be brought exclusively in the courts located in London, United Kingdom. The parties consent to personal jurisdiction and venue there. The above choices of venue do not prevent either party from seeking injunctive relief in any jurisdiction with respect to a breach of intellectual property rights or confidentiality obligations. The 1980 United Nations Convention on Contracts for the International Sale of Goods and its related instruments will not apply to this Agreement.

11.13 Cognism Affiliates and contractors. Cognism may perform its obligations under this Agreement through its Affiliates and use contractors to provide certain services. Cognism remains responsible for their performance.

11.14 Collaboration partners and publicity. Customer agrees that Cognism may disclose the fact that Customer is a client of Cognism. Throughout the Term, Customer grants Cognism the right to reference Customer’s name and logo in marketing materials and on Cognism’s website. Upon execution of the Agreement, Cognism may either (a) issue a press release announcing the relationship between Cognism and Customer, or (b) submit a joint press release to Customer for Customer’s approval, such approval not to be unreasonably withheld or delayed. Customer agrees to be a reference account for Cognism, provided however that Cognism will provide Customer with reasonable notice and obtain Customer’s consent before scheduling any reference calls.

11.15 Anti-Slavery. In performing its obligations under this Agreement, each party shall comply with all applicable anti-slavery and human trafficking laws, statutes, regulations and codes from time to time in force including, without limitation, the UK Modern Slavery Act 2015. Cognism shall ensure that any contracts with its sub-contractors require compliance with such laws.

11.16 Force majeure. A party shall not be in breach of this Agreement, or be liable for any failure or delay in performance of any obligations under this Agreement (except in the case of a failure to pay), where such failure or delay arises or is attributable to acts, events, omissions or accidents beyond its reasonable control (“Force Majeure”), including but not limited to fire, accidental damage, natural disaster, epidemic, pandemic, war, terrorist attack, riots, failure of machinery, computers or vehicles, industrial action, non-performance by suppliers or subcontractors (excluding companies in the same group as the party seeking to rely on this clause), or interruption or failure of utility service. A party subject to Force Majeure shall not be in breach of this Agreement provided it could not have avoided the effect of Force Majeure by taking precautions which it ought reasonably to have taken, and provided it promptly notifies the other party of the existence and nature of the Force Majeure, and uses reasonable endeavours to mitigate the effect of Force Majeure. If Force Majeure continues for more than 30 consecutive days, either party may terminate this Agreement immediately by giving written notice to the other party. Such termination shall be without prejudice to the rights of the parties in respect of any breach of this Agreement occurring before such termination.

11.17 Entire Agreement. This Agreement constitute the entire agreement and understanding between the parties with respect to the subject matter hereof and replaces any prior oral or written communications relating to the Services.

12. Definitions

“Affiliate” means any legal entity that controls, is controlled by, or is under common control with a party. In this context control means ownership of more than a 50% interest in an entity.

“Applicable Data Privacy Laws” shall have the meaning given to it in Appendix 1 (Data Processing Addendum) herein.

Business Day: a day (other than a Saturday or Sunday) on which banks in the City of London are open for ordinary banking business.

“Cognism” means the entity listed as a party on the Order.

“Confidential Information” means non-public information in any form that is marked as “confidential” or that a reasonable person should understand is confidential or proprietary given the nature of the information and the circumstances under which it is disclosed, including pricing, the terms of this Agreement, and other terms set forth in an Order. Confidential Information of Cognism includes, but is not limited to, non-public information regarding features, functionality and performance of the Services, API, and software code. Confidential Information of Customer includes Customer Data and Customer’s account authentication credentials.

“Customer” means the entity listed as Customer in the relevant Order.

“Customer Data” means any business data that Customer provides to Cognism or uploads to, transfers to, processes on, stores in, or causes to interface with the Cognism platform for data import, data validation and/or enrichment purposes as part of the Services, but specifically excludes Usage Data.

“Documentation” means all documentation and other instructional material made available by Cognism regarding the use of the Service, including any applicable Order.

“End User” means any person or machine account that Customer permits to use a Service or access Profile Data.

“Non-Cognism Application” means a web-based, offline, mobile, or other software application functionality that is provided by Customer or a third party and interoperates with the Services.

“Order” means the method by which Customer agrees to purchase Subscription Licenses to use a Service, including by order form.

“Service” means the Cognism-hosted service to which Customer may subscribe as set out in the relevant Order, but excluding Non-Cognism Applications.

“Representatives” means a party’s employees, Affiliates, contractors, advisors and consultants.

“Subscription License” means the license assigned to an End User.

“Subscription Term” means the license period agreed between the parties in the relevant Order.

APPENDIX 1 – DATA PROCESSING ADDENDUM

1. INTRODUCTION

1.1 This Data Processing Addendum (“DPA”) sets forth the terms and conditions relating to the privacy, confidentiality, security and protection of Protected Data (as defined below) to be processed as part of the (a) provision of the Services by Cognism and (b) receipt and use of the Services by the Customer pursuant to the services agreement entered into between Cognism and the Customer (the “Agreement”).

1.2 In the event of any conflict or inconsistency between the terms of this DPA and any other terms in the Agreement, this DPA shall prevail.

2. Definitions

2.1 Capitalized terms used but not defined in this DPA will have the meanings provided in the Agreement. The following terms shall have the meanings set out below:

2.2 For the purposes of this DPA, “controller”, “processor”, “data subject”, "Personal Data" and "process" shall have the meanings set out in the EU GDPR and "process" and "processed", will be construed accordingly, and will include both manual and automatic processing.

3. NATURE OF DATA PROCESSING

3.1 Scope and Application of the DPA. For the purpose of providing the Services under the Agreement, both Parties will receive and process Personal Data. This DPA applies to all (i) Customer Data; and (ii) Profile Data.

3.2 Respective Roles and Responsibilities. The Parties agree that (a) with regards to Customer Data, the Customer is the Controller and Cognism is the Processor, and (b) with regards to Profile Data, both Cognism and the Customer will process such data as independent controllers.

3.3 Nature and Details of Processing. The nature and details of Processing are set forth in Annex 1 to this DPA (Details of Data Processing), Part 1 of the Annex sets out the details of the processing activities in relation to Customer Data (Details of Data Processing – Controller-to-Processor), and Part 2 sets out the details of the processing activities in relation to Profile Data (Details of Data Processing – Controller-to-Controller).

3.4 Mutual Obligations. The Parties shall at all times comply with their respective obligations under Data Protection Laws and with their respective obligations under this DPA in connection with the processing of the Protected Data as part of the Services provided under the Agreement.

4. CUSTOMER PERSONAL DATA PROCESSING

4.1 Cognism Obligations. Insofar as Cognism processes Customer Data on behalf of the Customer, Cognism shall (a) unless required to do otherwise to ensure compliance with Data Protection Laws, only act upon and process Customer Data in accordance with the Customer’s instructions as set out in Annex 1 to this DPA, or as otherwise provided by the Customer to Cognism in writing from time to time (“Processing Instructions”). If Cognism believes that any Processing Instruction received by it from the Customer is likely to infringe the Data Protection Laws, it shall promptly inform the Customer and be entitled to cease to provide the relevant Services until the parties have agreed appropriate amended instructions which are not infringing. The Subscription Fees payable to Cognism shall not be discounted or set-off as a result of any delay or non-performance of any obligation in accordance with this clause 4.1 (a); (b) ensure that the personnel who has access to Customer Data (i) receive adequate training in compliance with this DPA and Data Protection Laws; (ii) are under an obligation to maintain the security and confidentiality of any Customer Data which they have access to, and (iii) do not process Customer Data other than in accordance with the Processing Instructions, unless as otherwise required under applicable law; (c) taking into account the nature of the processing, take all appropriate technical and organisational measures, Cognism shall, at the Customer’s cost, co-operate with and provide all necessary assistance to enable the Customer to comply with its obligations under Articles 32 to 36 (inclusive) of the EU GDPR in relation to the Customer Data or any other equivalent obligations under other applicable Data Protection Laws including in relation to respond to any requests from any data subject(s) and/or any Supervisory Authority; (d) notify the Customer without undue delay, and in any event within 48 hours, upon becoming aware of a Data Breach relating to Customer Data; (e) where processing Customer Data on behalf of the Customer within the scope of the CCPA, not retain, use, or disclose such personal data for any purposes other than the purposes set out in the Agreement and this DPA and as permitted under the CCPA, including under any “sale” exemption; and (f) cease processing of the Customer Data and, at the Customer’s written request, either delete or return the Customer Data after the business purposes for which the Customer Data was processed have been fulfilled or terminated, whichever is earlier, unless continued processing is required under Applicable Data Protection Law.

4.2 Customer Obligations. The Customer represents and warrants that (a) the Customer Data which it supplies or discloses to Cognism under the Agreement has been obtained fairly and lawfully; (b) it has provided all necessary fair processing information to data subjects and obtained all necessary and appropriate consents from them to enable (i) the Customer to lawfully transfer the Customer Data to Cognism; and (ii) Cognism to process the Customer Data in accordance with this DPA and the Agreement; (c) the Processing Instructions will not breach, and will not cause Cognism to breach, applicable Data Protection Law; and (d) the Customer Data is accurate, up-to-date and not excessive or irrelevant in relation to the purposes for which Cognism will process the Customer Data.

4.3 Sub-Processors. Cognism is hereby authorised by the Customer to engage its Affiliates and third party service providers as listed in annex 1 herein (“Approved Sub-Processors”) to process the Customer Data as sub-processors as required to enable Cognism to fulfil its obligations under the Agreement. In the event Cognism intends to add or replace any Approved Sub-Processor, Cognism shall inform the Customer in order to give the Customer the opportunity to object to such changes within thirty (30) days, provided such objection is based on reasonable grounds relating to data protection. Cognism shall (i) ensure that the new sub-processor is contractually bound to substantially similar obligations as to the obligations under this DPA with respect to the processing of the Customer Data; and (ii) remain fully liable to the Customer for the sub-processors’ acts or omissions with regards to its processing of the Customer Data.

4.4 Audit. Cognism will conduct audits of its security controls applied to the processing of the Customer Data. Each audit will be performed according to the rules of the accreditation body for each applicable control standard or framework and will be performed by qualified, independent, third-party security auditors at Cognism’s selection and expense. Each audit will result in the generation of an audit report, which Cognism may make available to the Customer in a redacted version, subject to non-disclosure and distribution limitations of Cognism and the auditor. To the extent the Customer’s audit requirements under applicable Data Protection Laws cannot reasonably be satisfied through the audit reports or other information Cognism makes generally available to the Customer, Cognism will respond to the Customer’s additional requests to provide information to the extent necessary to demonstrate Cognism's compliance with its obligations as data processor under Article 28 of the GDPR. In the event an onsite audit of Cognism’s premises is required, the Customer shall provide a reasonable prior written advance and before the commencement of such audit, Cognism and the Customer will, acting in good faith, mutually agree upon the scope, timing, duration, control and evidence requirements. The Customer agrees that the audit will be conducted without unreasonably interfering with Cognism’s business activities, during regular business hours and subject to Cognism's security policies and confidentiality procedures. Where onsite audits of physical data centers are not permitted, the Customer will work with Cognism to reach a mutually agreeable resolution sufficient to provide information necessary for the Customer to fulfil its obligations under applicable Data Protection Laws.

5. PROFILE DATA PROCESSING

5.1 Independent Controller Obligations. With regards to the processing of Profile Data, either party shall (a) ensure that it is not subject to any prohibition or restriction which would prevent or restrict it from disclosing or transferring the Personal Data to the other party, as required under this DPA; (b) ensure that all fair processing notices have been given and are sufficient in scope and kept up-to-date in order to meet the Transparency Requirements (as defined under Data Protection Law) to enable each party, subject to such party’s own compliance with the Data Protection Law, to process the Personal Data under this DPA in accordance with the Data Protection Law. Each party must and will independently ensure that (i) they have a lawful basis for their Processing of such Personal Data, and (ii) such use and Processing of the Personal Data is compliant with the Data Protection Law; (c) ensure that the Personal Data is adequate, relevant, limited to what is necessary in relation to the permitted purpose and, where necessary, up-to-date; and (d) ensure that the Profile Data is transferred between the parties by a secure means.

5.2 Processing Activities. The transfer of Profile Data by Cognism is based on the Customer’s business-to-business sales, marketing, recruiting, or business development activities as specified in the Agreement (collectively, “B2B Activities”). The Customer will only process the Profile Data for its B2B Activities or as otherwise permitted under the Agreement.

5.3 Cognism Warranties. Cognism hereby warrants that (a) it has collected all Profile Data provided to Customer as part of the Services in compliance with the Data Protection Laws; (b) it will promptly honor any opt-out requests it receives from data subjects in the Services in accordance with the Data Protection Law; and (c) it will make available to Customer a list of data subjects who have requested that their Personal Data be removed from the Services.

5.4 Customer Warranties. The Customer hereby warrants (a) it will process the Profile Data in compliance with applicable Data Protection Laws; and (b) it will comply promptly with any opt-out requests received by Cognism by deleting securely and permanently such Profile Data from their systems.

5.5 Technical and Organisational Security Measures. Each party shall implement and maintain (in accordance with Data Protection Law) appropriate technical and organisational measures taking into account the state of the art, the implementation costs, and the nature, scope, circumstances and purpose of the processing, as well as the different probability of occurrence and the severity of the risk of the rights and freedoms of the persons concerned in order to ensure a level of protection appropriate to such risk. Such measures shall at all times: (a) be of at least the minimum standard required by Applicable Data Protection Laws; (b) in respect of Cognism, comply with the measures as set out in Annex 2 herein (“TOMs”); and (c) be of a standard no less than the standard compliant with good industry practices for the protection of Personal Data.

5.6 Reporting. The parties shall each comply with its obligation under Data Protection Law to report a Data Breach to the appropriate supervisory authority and (where applicable) data subjects.

5.7 Data Subject Rights. The parties each agree to provide such assistance as is reasonably required to enable the other party to comply with requests from Data Subjects to exercise their rights under the Data Protection Law within the time limits imposed by the Data Protection Law.

6. INTERNATIONAL TRANSFERS OF PERSONAL DATA

6.1 Non-Adequate Jurisdictions. To the extent Protected Data is transferred to other countries that have not been recognized under the Applicable Data Protection Laws as an Adequate Jurisdiction (“Non-Adequate Jurisdiction”), the relevant Standard Contractual Clauses (“SCCs”) contained in Annex 3 to this DPA will apply.

6.2 Standard Contractual Clauses. For the purposes of the SCCs, the following additional provisions shall apply (a) with regards to Profile Data, Cognism shall be regarded as the data exporter and Customer shall be regarded as the data importer, (b) with regards to Customer Personal Data, the Customer shall be regarded as the data exporter and Cognism shall be regarded as the data importer; (c) the parties agree to observe the terms of the SCCs without substantive modification, except as listed in Annex 5 (Standard Contractual Clauses) herein; and (d) In the event of any conflict between the provisions of (i) the SCCs; and (ii) the remaining terms of this DPA, then the SCCs, or any replacement thereof, shall take precedence. The terms of this DPA shall not vary the SCCs in any way.

7. US State privacy laws

7.1 Compliance. To the extent that either party processes any Protected Data relating to individuals who are “consumers” as that term is defined in the applicable US Law, the party shall comply with the applicable requirements under the applicable US Law, and shall provide the same level of privacy protection as required by the applicable US Law, including by implementing and maintaining reasonable security procedures and practices appropriate to the nature of the Protected Data to protect the Protected Data from unauthorized or illegal access, destruction, use, modification, or disclosure.

7.2 CCPA. To the extent that Cognism processes any Customer Data relating to individuals who are California residents, Cognism shall, to the extent required by the applicable US Law: (a) grant the Customer the right to take reasonable and appropriate steps to help ensure that Cognism uses the Customer Data in a manner consistent with Cognism’s obligations under the applicable US Law; (b) grant the Customer the right, upon reasonable notice, to take reasonable and appropriate steps to stop and remediate any unauthorized use of the Customer Data; and (c) promptly notify the Customer if Cognism determines that it can no longer meet its obligations under the applicable US Law.

8. Liability

8.1 Each Party’s liability under this DPA shall be construed in a manner consistent with the limitations of liability set out in the Agreement.

9. GOVERNING LAW AND JURISDICTION

9.1 This DPA and any non-contractual obligations arising out of or in connection with it shall be governed by and interpreted in accordance with the laws of England and Wales.

9.2 Each party irrevocably submits to the exclusive jurisdiction of the courts of London, England over any claim or matter arising under, or in connection with, this DPA.

ANNEX 1 – DETAILS OF PROCESSING ACTIVITIES

PART 1 – Controller-to-Processor processing of Customer Data

A. PARTIES

Controller:

Processor:

B. DATA PROCESSING AND TRANSFER OF PERSONAL DATA

PART 2 – Controller-to-Controller processing of Profile Data

A. PARTIES

Data exporter:

Data importer:

B. DATA PROCESSING AND TRANSFER OF PERSONAL DATA

ANNEX 2

TOMs

1. Access Controls

Access controls ensure that access to Cognism systems, applications, and data is granted on a need-to-know, least-privilege basis, authenticated strongly, and reviewed on a recurring basis. The following measures govern how identities are provisioned, authenticated, authorised, monitored, and de-provisioned across the environment.

Identity Lifecycle & Authorisation

• Access is provisioned through standardized request workflows with formal approval aligned to defined role requirements
• Access rights are reviewed periodically to ensure continued appropriateness and compliance
• Access is managed using a Role-Based Access Control (RBAC) model aligned to job responsibilities
• Access is granted following the principle of least privilege
• All provisioning and access changes are logged and monitored within the SIEM
• MFA and SSO are enforced to strengthen authentication and access control across all systems where applicable

Additional high-level measures

• Privileged access is restricted and time-bound where feasible, and subject to enhanced monitoring and review
• Administrative access requires strong authentication, encrypted channels, and zero-trust access controls for remote administration
• Periodic access certifications are performed at least semi-annually for in-scope systems; remediation actions are tracked to completion

2. Vulnerability Management

Cognism maintains a continuous vulnerability management programme that identifies, prioritises, and remediates weaknesses across infrastructure, application code, and third-party dependencies. The programme combines automated scanning, manual testing, independent penetration testing, and a public disclosure channel, with remediation governed by internal service level agreements aligned to business risk.

Detection & Testing

• There is continuous vulnerability scanning of the infrastructure and code packages
• Tests include both automated tools and manual testing techniques (QA)
• Independent penetration testing is performed at least annually with documented remediation plans and verification
• There is an ongoing vulnerability disclosure program

Prioritisation & Remediation

• Vulnerabilities are tracked in our ticketing system with severity-based remediation timelines, and remediation is verified through retesting and validation scans before closure
• Vulnerabilities are prioritised depending on the real business risk, considering the exploitability, severity, CVSS, and EPSS score
• Vulnerabilities are tracked and remediated as per our internal SLAs

3. Secure Development Standard

Cognism's secure development standard governs how software and infrastructure are designed, built, reviewed, tested, and released. It combines environment separation, a formal Software Development Lifecycle (SDLC), secure coding practices, and automated security controls in CI/CD pipelines to reduce the likelihood of vulnerabilities being introduced into production.

• Separated environments for development, staging and production
• A formal SDLC defines requirements for design, build, test (including security testing), approval, and release, including emergency changes
• Secure coding standards, secrets scanning, IaC, SAST, and SCA run in CI/CD
• Changes to infrastructure and application components are documented, tested in non-production, peer-reviewed, and approved prior to release

4. Logging, Monitoring & Detection

Cognism operates a centralised, always-on monitoring capability that combines log aggregation, threat detection, endpoint protection, and human-led response. The programme is designed to provide early detection of malicious activity, support investigations, and maintain visibility across cloud, application, and endpoint layers.

• Centralised logging (SIEM) collects security and audit events from cloud, application, and endpoint sources; alerts are triaged and investigated
• A 24/7 Security Operations Center (SOC) provides continuous security monitoring, detection, and incident response capabilities
• Intrusion detection/threat detection services monitor malicious activity across cloud accounts, networks, and endpoints
• Infrastructure and application health are monitored with alerting on performance and availability thresholds
• Malware protection is deployed on relevant systems with MDR functionality
• Cloud Security Posture Management (CSPM) tooling continuously monitors cloud environments for configuration drift, misconfigurations, and policy violations

5. Supplier & Cloud Security

Third parties and cloud service providers are integral to Cognism's service delivery. Supplier and cloud security measures ensure that providers are appropriately vetted prior to onboarding, contractually bound to security obligations, operated against hardened configuration baselines, and offboarded through controlled exit procedures.

Onboarding & Ongoing Assurance

• Third-party and cloud providers are assessed prior to onboarding and reviewed at least annually for security and availability commitments
• Contractual requirements include security controls, incident notification, and service levels; NDAs are executed before information sharing

Cloud Configuration & Offboarding

• Cloud environments follow secure configuration baselines; network segmentation, WAF, and firewall rule reviews help prevent unauthorised access
• Exit procedures ensure secure data export and deletion at the end of a relationship

6. Incident Response & Business Continuity

Cognism maintains documented incident response and business continuity capabilities to detect, respond to, and recover from security events and service disruptions. These capabilities are exercised on a regular basis and include defined roles, escalation paths, customer communications, and recovery objectives for critical services.

Incident Response

• A documented incident response plan defines roles, escalation paths, triage, containment, eradication, recovery, and post-incident review
• Regular simulated phishing campaigns are conducted to test employee awareness and resilience against social engineering attacks, with results used to inform targeted remediation and training
• Incidents and security events are logged, tracked to resolution, and communicated to relevant stakeholders in line with defined procedures
• Customer-facing channels exist for reporting service incidents or concerns

Business Continuity & Disaster Recovery

• Business Continuity and Disaster Recovery plans set RTO/RPO targets, roles, and communications; plans are exercised at least annually

7. Availability & Resilience

Availability and resilience measures ensure that Cognism's critical services remain operational under expected demand, recover quickly from disruption, and protect against data loss. Capacity is monitored continuously, backups are performed on a recurring basis to logically separate locations, and databases are replicated across geographic or logical fault domains.

• Capacity is monitored and scaled to meet demand; resilience patterns are used for critical services
• Production data is backed up at least daily to a logically separate location; restoration procedures are tested
• Databases are replicated to secondary regions or availability zones with alerting on replication failures
• DDoS protection and content delivery is enforced through a CDN and DDoS mitigation service, protecting the availability of customer-facing services against volumetric and application-layer attacks

8. Cryptography

Cognism uses cryptographic controls to protect personal data both in transit and at rest, supported by industry-standard key management practices. Encryption configurations are aligned with recognised best practice and enforced across databases, storage, and backups.

• Encryption in transit (TLS) with a minimum of TLS 1.2
• Encryption at rest (AES-256) is enforced for databases, data storage, and backups
• Key management follows industry best practices
• Globally used keys are AWS-managed keys

9. Physical & Environmental Security

Cognism's production infrastructure is operated within a leading cloud service provider, inheriting their physical and environmental controls under the shared responsibility model. Corporate offices implement controls proportionate to risk, and data-bearing assets are securely handled throughout their lifecycle.

• Production infrastructure is hosted within AWS, following the shared responsibility model
• Infrastructure is primarily deployed in eu-west-1 region (Ireland)
• Corporate offices use controlled entry, video surveillance, and secure areas where appropriate
• Employee laptops and mobile devices are enrolled in a Mobile Device Management (MDM) solution, enabling central policy enforcement and configuration management
• Asset disposal ensures data-bearing devices are securely wiped/destroyed prior to reuse or disposal

10. HR & People Security

People are a critical layer of Cognism's control environment. HR and people security measures address pre-employment screening, confidentiality obligations, disciplinary processes, and ongoing security and privacy awareness training for all personnel.

• Pre-employment screening is performed in accordance with local laws and role risk for both full-time employees and contractors
• Employees acknowledge confidentiality and acceptable use obligations
• Violations are subject to a disciplinary process
• Security and privacy awareness training is delivered upon hire and at least annually

11. Governance, Risk & Compliance

Cognism's governance, risk, and compliance programme provides the overarching framework within which all technical and organisational measures are designed, operated, and assured. The programme is governed by a documented policy framework, informed by regular risk assessments, and validated through internal and external reviews.

• An information security policy framework is documented, reviewed at least annually, and communicated to staff
• Risk assessments are performed at least annually, including consideration of fraud, regulatory, and technology changes
• Control self-assessments, internal audits, and management reviews evaluate ISMS and control effectiveness; corrective actions are tracked
• Cyber insurance is maintained to mitigate financial impact from security incidents and business disruptions

ANNEX 3

Standard Contractual Clauses (“SCCs”)

I. Transfer Clauses Generally

With respect to transfers of Personal Data across national borders to other countries that have not been recognized under the Applicable Data Protection Laws as an Adequate Jurisdiction, the parties hereby agree to be bound by, where applicable:

(1) For transfers of Personal Data from an EEA Data Exporter to a Non-Adequate Jurisdiction, the Controller-to-Controller EU SCCs are deemed incorporated into this DPA in their entirety and without alteration, except as noted below. To the extent that the Data Importer is subject to the extra-territorial scope of Article 3(2) of the EU GDPR with respect to the specific processing, the obligations imposed on the Data Importer by the EU GDPR shall prevail over its obligations under the SCCs, where the latter are less strict. For reference, the official EU SCCs are available here;

(2) For transfers of Personal Data from a UK Data Exporter to a non-Adequate Jurisdiction, the SCCs (as referred to above in section (i)) and the UK SCC Addendum is applicable here;

(3) For transfers of Personal Data from any other applicable jurisdiction with SCCs, the relevant the Controller-to-Controller SCCs are deemed incorporated in their entirety and without alteration as required and relevant under such jurisdiction’s applicable law.

II. EU SCCs

When both parties are acting as Controllers, and when the EEA Data Exporter transfers Personal Data to a non-Adequate Jurisdiction, Module 1 of the EU SCCs applies. With respect to Module 1 of the EU SCCs, the parties hereby further agree that:

(1) Clause 7 of the SCCs - Docking Clause applies;

(2) Clause 9 of the SCCs is intentionally omitted;

(3) the following provision under Clause 13(a) of Module 1 of the EU SCCs applies:

The supervisory authority with responsibility for ensuring compliance by the data exporter with Regulation (EU) 2016/679 as regards the data transfer, as indicated in Annex I.C, shall act as competent supervisory authority.

(4) the following provision under Clause 17 of Module 1 of the EU SCCs applies:

These Clauses shall be governed by the law of one of the EU Member States, provided such law allows for third-party beneficiary rights. The parties agree that this shall be the laws of the Republic of Ireland.

(5) the following provision under Clause 18(b) of Module 1 of EU the SCCs applies:

The parties agree that those shall be the courts of the Republic of Ireland.

(6) with respect to Annex I of the EU SCCs, the details of the data exporter and data importer are set forth in clause 6.2 of this DPA.

(7) with respect to Annex I of the EU SCCs the description of the transfer are set forth in Annex 1 of this DPA.

(8) with respect to Annex II of the EU SCCs the description of the technical and organisational security measures are set forth in Annex 2 of this DPA.

(9) with respect to Annex III of the EU SCCs the details of the sub-processors are set forth here.

III. Adjustments to the EU SCCs for Personal Data Transfers from Switzerland

A. To the extent that the Data Exporter is established in Switzerland and transfers Personal Data related only to Swiss data subjects to a Non-Adequate Jurisdiction, the Swiss DPA applies to the transfers of Personal Data and, therefore, the following adjustments to the EU SCCs shall apply to ensure an adequate level of protection for the transfers of Personal Data outside Switzerland in accordance with the Swiss DPA:

(1) Annex I.C under Clause 13 of the EU SCCs:

With regard to the Swiss entity as a data exporter, the competent supervisory authority is the Federal Data Protection and Information Commissioner (“FDPIC”);

(2) Clause 17 of the EU SCCs:

The law governing the Standard Contractual Clauses is Swiss law;

(3) The use of the term ‘EU Member State’ in the EU SCCs must not be interpreted in such a way as to exclude data subjects in Switzerland from the possibility of suing for their rights in their place of habitual residence (Switzerland) in accordance with Clause 18 of the EU SCCs;

(4) References to the EU GDPR in the EU SCCs are to be understood as references to the Swiss DPA.

B. To the extent that the Data Exporter is established in Switzerland and transfers Personal Data related (also) to EEA data subjects to a non-Adequate Jurisdiction, or if the transfers of Personal Data are otherwise subject to the extraterritoriality provisions of the EU GDPR (Article 3), the Swiss DPA and the EU GDPR apply in parallel to the transfers of Personal Data. In this case, the parties agree that the EU GDPR standard will apply to the transfers of Personal Data because the EU GDPR provides adequate protection and data subjects are consequently not disadvantaged as a result of the transfers. The following adjustments to the SCCs shall apply:

(1) Annex I.C under Clause 13 of the EU SCCs:

With regard to the Swiss entity as a data exporter, the competent supervisory authorities are the FDPIC, insofar as the transfers of Personal Data are governed by the Swiss DPA, and the EEA competent supervisory authority as indicated in Annex I.C of the EU SCCs, insofar as the transfers of Personal Data are governed by the EU GDPR;

(2) the use of the term ‘EU Member State’ in the EU SCCs must not be interpreted in such a way as to exclude data subjects in Switzerland from the possibility of suing for their rights in their place of habitual residence (Switzerland) in accordance with Clause 18 of the EU SCCs;

(3) with respect to Annex I of the EU SCCs, the details of the data exporter and data importer are set forth in clause 6.2 of this DPA.

(4) with respect to Annex I of the EU SCCs the description of the transfer are set forth in Annex 1 of the DPA.

(5) with respect to Annex II of the EU SCCs the description of the technical and organisational security measures are set forth in Annex 2 of this DPA.

(6) with respect to Annex III of the EU SCCs the details of the sub-processors are set forth here.

IV. UK SCC Addendum

With respect to the UK SCC Addendum, the parties agree that:

(1) with respect to Table 1 of the UK SCC Addendum, the details of the data exporter and data importer are set forth in clause 6.2.1 of the DPA;

(2) with respect to Table 2 of the UK SCC Addendum, the version of the SCCs in force at the date of execution of this DPA applies;

(3) with respect to Table 3 of the UK SCC Addendum, (a) the description of the parties is set forth in clause 6.2 of this DPA, (b) the details of the processing are set forth in Annex 1 of this DPA, and (c) the description of the technical and organisational security measures are set forth in Annex 2 of this DPA;

(4) with respect to Table 4 of the UK SCC Addendum, no parties may end the UK SCC Addendum as set out in Section 19 of the UK SCC Addendum.