Data Processing Addendum

For the purposes of this Addendum:

 “CCPA” means the California Consumer Privacy Act of 2018, as amended from time to time;

 “Client Personal Data” means the Personal Data described under Section 2 of this Addendum;

 “Controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the Processing of Personal Data;

 “Data Protection Legislation” means all applicable legislation relating to data protection and privacy including, where applicable, the European Data Protection Laws and the CCPA;

 “Data Subject” means the individual to whom Personal Data relates;

 “European Data Protection Laws” means the GDPR, the Data Protection Act 2018 of the United Kingdom and the Swiss Federal Act on Data Protection, each as amended or replaced from time to time;

 “EU Standard Contractual Clauses” means the clauses approved with the European Commission’s Implementing Decision (EU) 2021/914 of 4 June 2021 on Standard Contractual Clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council, as amended, supplemented, updated or replaced from time to time;

 “GDPR” means the General Data Protection Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and any national implementing laws in any Member State of the European Union (“EU GDPR”) and the EU GDPR in such form as incorporated into the laws of the United Kingdom (“UK GDPR”), each as amended or replaced from time to time;

 “Personal Data” means any information relating to an identified or identifiable Data Subject;

 “Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored or otherwise processed;

 “Processing” means any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction. The terms “process”, “processes” and “processed” will be construed accordingly;

 “Processor” means a natural or legal person, public authority, agency or other body which processes Personal Data on behalf of the Controller; and

 “UK Controller to Processor Standard Contractual Clauses” means the Standard Contractual Clauses for controller to processor transfers set forth in the European Commission’s decision (C(2010)593) of 5 February 2010.

Capitalized terms not otherwise defined herein shall have the meaning given to them in the Agreement.

Categories of Data Subjects. This Addendum applies to the Processing of Client Personal Data relating to customers or other end users of the Client who use the applications developed by the Client.

Types of Personal Data. Client Personal Data includes Data Subjects’ email, name and IP address, and other Personal Data that Client may submit through or upload to the Company’s systems the extent of which is determined and controlled by the Client in its sole discretion.

Subject-Matter, Nature And Purpose of The Processing. The subject-matter, nature and purpose of Processing of Personal Data by Company is the provision of the Services to the Client that involves the Processing of Client Personal Data, as set out into the Agreement and any applicable Statement of Work.

Duration of The Processing. Client Personal Data will be Processed for the duration specified in the Agreement until deletion or return of Client Personal Data as instructed by the Client under this Addendum.

The parties acknowledge and agree that Client is either the Controller of Client Personal Data, or if Client is Processing Client Personal Data on behalf of a Controller, then Client is a Processor, and in each case the Company is the Processor of Client Personal Data. Company will only Process Client Personal Data on behalf of and in accordance with the Client’s prior written instructions. Company is hereby instructed to Process Client Personal Data to the extent necessary to enable Company to provide the Services in accordance with the Agreement. In case Processing is required by the Data Protection Legislation to which the Company is subject, the Company shall (i) promptly notify the Client of that legal requirement and/or of the inability to comply with any instructions before the relevant Processing, to the extent permitted by the Data Protection Legislation; and (ii) cease all Processing (other than merely storing and maintaining the security of the affected Client Personal Data) until such time as the Client issues new instructions with which Company is able to comply (and if this provision applies, Company will not be liable to the Client under the Agreement in respect of any inability to perform the Services until such time as the Client issues new instructions).

Client shall, in its use of the Services, Process Client Personal Data in accordance with the requirements of the Data Protection Legislation. For the avoidance of doubt, Client’s instructions for the Processing of Client Personal Data shall comply with the Data Protection Legislation. Client shall ensure that Client has provided or will provide any necessary notices to Data Subjects, and has obtained or will obtain all necessary rights and consents (to the extent required) for Company to Process Client Personal Data in accordance with this Addendum. If Client is a Processor for Client Personal Data under this Addendum, Client warrants that its instructions and actions with respect to the Client Personal Data, including its engagement of Company as a Processor pursuant to this Addendum, have been authorized by the relevant Controller.

The Client acknowledges that the Company is reliant on the Client for direction as to the extent to which Company is entitled to Process Client Personal Data on behalf of Client in performance of the Services. Consequently, the Company will not be liable under the Agreement for any claim brought by a Data Subject arising from any action or omission by the Company, to the extent that such action or omission resulted directly from the Client’s instructions or from Client’s failure to comply with its obligations under the applicable Data Protection Legislation.

The parties hereby agree that, where Client is a Controller and Company is a Processor, Module Two (Controller to Processor Module) of the EU Standard Contractual Clauses and all other sections of the EU Standard Contractual Clauses having general application (hereinafter, “C2P SCCs”) shall apply to the transfer of Client Personal Data originating from the EEA and Switzerland to the Company in the United States and the parties agree to comply with the C2P SCCs, which are hereby incorporated into this Addendum by this reference. Where Client is a Processor and Company is a sub-Processor to Client, Module Three (Processor to Processor Module) of the EU Standard Contractual Clauses and all other sections of the EU Standard Contractual Clauses having general application (hereinafter, “P2P SCCs”) shall apply to such transfers and the parties agree to comply with the P2P SCCs, which are hereby incorporated into this Addendum by this reference. In furtherance of the foregoing, the parties agree that, for purposes of the C2P SCCs and the P2P SCCs:

where Company is a Processor, Company will comply with all the obligations of the “data importer” under the C2P SCCs. Where Company is a sub-Processor to the Client, Company shall comply with all the obligations of the “data importer” under the P2P SCCs. In each case, Client shall comply with the obligations, and shall have the rights, of the “data exporter” under the C2P SCCs and the P2P SCCs, respectively;

for the purpose of Clause 17, the C2P SCCs and the P2P SCCs, as applicable, shall be governed by the laws of Ireland;

for the purpose of Clause 18(b), the parties agree to submit to the jurisdiction of the courts of Ireland;

in Clause 7, the optional docking clause will not apply;

in Clause 9(a), Option 2 will apply and the time period for prior notice of sub-Processor changes will be as set forth in Section 7.1 of this Addendum;

in Clause 11, the optional language regarding independent dispute resolution will not apply;

for the purposes of Annex I, Section A (List of Parties), (i) the data exporter’s and the data importer’s identity and contact details and, where applicable, information about their respective data protection officer and/or representative in the EEA are those set forth in the Agreement or as otherwise communicated by each party to the other party; (ii) Client is either the Controller (under the C2P SCCs) or the Processor (under the P2P SCCs), and Company is a Processor (under the C2P SCCs and the P2P SCCs); (iii) the activities relevant to the data transferred relate to the provision of the Services pursuant to the Agreement; and (iv) each of the Company’s and the Client’s entering into this Addendum shall be treated as, respectively, Company’s and Client’s signature of Annex I, Section A, of the C2P SCCs and the P2P SCCs as of the Effective Date of this Addendum;

for the purposes of Annex I, Section B (Description of Transfer): (i) Section 2 of this Addendum sets out a description of the Processing of Client Personal Data; (ii) the frequency of the transfer is continuous (for as long as the Client uses the Services); (iii) Client Personal Data will be retained in accordance with Clause 8.5 of the C2P SCCs and the P2P SCCs, as applicable, and this Addendum; (iv) Company engages sub-Processors as described in Section 7 of this Addendum;

for the purposes of Annex I, Section C (Competent Supervisory Authority), the competent supervisory authority identified in accordance with Clause 13 of the C2P SCCs and the P2P SCCs, as applicable, is the competent supervisory authority communicated by Client to Company;

for the purposes of Annex II, Company has implemented and will maintain appropriate technical and organizational measures to protect the security, confidentiality and integrity of Client Personal Data as described at Annex B to this Addendum or as otherwise made reasonably available by Company to the Client.

Insofar as the transfer of Client Personal Data is subject to the Swiss Federal Act on Data Protection, the following provisions apply: (i) the Federal Data Protection and Information Commissioner (FDPIC) will be the competent supervisory authority under Clause 13 of the C2P SCCs or the P2P SCCs, as applicable; (ii) the parties agree to abide by the GDPR standard in relation to all Processing of Client Personal Data that is governed by the Swiss Federal Act on Data Protection; (iii) the term ‘Member State’ in the C2P SCCs and the P2P SCCs will not be interpreted in such a way as to exclude Data Subjects in Switzerland from the possibility of suing for their rights in their place of habitual residence (Switzerland) in accordance with Clause 18(c) of the C2P SCCs and the P2P SCCs; and (iv) references to the ‘GDPR’ in the C2P SCCs and the P2P SCCs will be understood as references to the Swiss Federal Act on Data Protection insofar as the transfer of Client Personal Data is subject to the Swiss Federal Act on Data Protection.

With respect to transfers of Client Personal Data originating from the United Kingdom, the parties agree to comply with the UK Controller to Processor Standard Contractual Clauses, which are incorporated herein by reference. The parties agree that, for the purposes of the UK Controller to Processor Standard Contractual Clauses: (i) Client shall act and comply with the obligations as the “data exporter”, and Company shall act and comply with the obligations as the “data importer”; (ii) all references to the “Directive 95/46/EC” and its provisions shall be deemed to refer to the relevant provisions of the UK GDPR and the Data Protection Act 2018 of the United Kingdom; (iii) all references to the “Commission” shall be deemed to refer to the Information Commissioner; (iv) all references to the “European Economic Area” or the “European Union” shall be deemed to refer to the United Kingdom; (v) for the purposes Appendix 1 to the UK Controller to Processor Standard Contractual Clauses, categories of Data Subjects, types of Personal Data and of Processing operations are as set out at Section 2 of this Addendum; and (vi) for the purposes Appendix 2 to the UK Controller to Processor Standard Contractual Clauses, the Company’s security measures are as described at Annex B to this Addendum. The parties acknowledge that the Information Commissioner’s Office has not yet approved new standard contractual clauses under the UK GDPR. The UK Controller to Processor Standard Contractual Clauses will apply only until such time as the Information Commissioner’s Office issues new standard contractual clauses under the UK GDPR. The parties shall work together, in good faith, to enter into an updated version of the UK Controller to Processor Standard Contractual Clauses or negotiate an alternative solution to enable transfers of Client Personal Data in compliance with the UK GDPR.

The C2P SCCs and the P2P SCCs shall automatically terminate if the European Data Protection Board or other competent authorities determine that EU Standard Contractual Clauses are not applicable to the transfers of Client Personal Data to the Company.

Company will ensure that any person whom Company authorizes to Process Client Personal Data on its behalf is subject to confidentiality obligations in respect of that Client Personal Data.

Company will implement appropriate technical and organizational measures to protect against accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Client Personal Data, including, as appropriate,

the pseudonymization of Client Personal Data,

ensuring the ongoing confidentiality, integrity, availability, and resilience of Processing systems and services,

restoring the availability and access to Client Personal Data in a timely manner in the event of a physical or technical incident, and

regularly testing, assessing, and evaluating the effectiveness of technical and organizational measures for ensuring the security of the Processing

Client hereby grants general written authorization to Company to appoint sub-Processors to perform specific services on Company’s behalf which may require such sub-Processors to Process Client Personal Data. For the avoidance of doubt, the above authorization constitutes Client’s prior written consent to the sub-Processing by the Company for purposes of Clause 9(a) of the C2P SCCs or Clause 9(a) of the P2P SCCs, as applicable. The sub-Processors appointed by Company as at the date of this Addendum are set out at https://docs.instabug.com/docs/sub-processors. If Company engages a sub-Processor to Process any Client Personal Data, it will:

Inform Client of any intended changes concerning the addition or replacement of such sub-Processors at least fifteen (15) days in advance, along with reasonably detailed information about such new sub-Processor, and Client will have an opportunity to object to such changes on reasonable grounds within thirty (30) business days after being notified in accordance with the mechanism set out in Section 7.2. If the parties are unable to resolve such objection, either party may terminate the Agreement by providing written notice to the other party; and

Enter into a binding written agreement with the sub-Processor that imposes on the sub-Processor the same obligations that apply to Company under this Addendum.

Customer may receive notifications of new Sub-processors by e-mailing dpa@instabug.com with the subject “Subscribe”, and if a Customer contact subscribes, Instabug shall provide the subscriber with notification of new Sub-processor(s) before authorizing such new Sub-processor(s) to Process Personal Data in connection with the provision of the applicable Services.

Taking into account the nature of the Processing, Company shall assist the Client by appropriate technical and organizational measures, insofar as this is possible and to the extent Company is legally permitted to do, for the fulfillment of the Client’s obligation to respond to Data Subjects’ requests for the exercise of Data Subjects’ rights under the Data Protection Legislation. Client shall be solely responsible for responding to such requests.

At the Client’s request, Company will provide the Client with reasonable assistance to facilitate conducting data protection impact assessments and consultation with competent data protection authorities if the Client is required to do so under the Data Protection Legislation, in each case solely to the extent that such assistance is necessary and relates to the Processing by the Company of the Client Personal Data, taking into account the nature of the Processing and the information available to the Company.

Company will, at the Client’s request, provide the Client with reasonable assistance as necessary for the fulfillment of the Client’s obligation to implement appropriate security measures to protect Client Personal Data.

Company will:

notify the Client without undue delay after it becomes aware of any Personal Data Breach affecting any Client Personal Data; and

at the Client’s request, promptly provide the Client with all reasonable assistance necessary to enable the Client to notify relevant Personal Data Breaches to competent authorities and/or affected Data Subjects, if Client is required to do so under the Data Protection Legislation.

Upon termination or expiration of the Agreement, the Company will either delete or return (at the election of the Client) the Client Personal Data in its possession as set out in the Agreement within a reasonable timeframe.

Company will provide the Client with all information necessary to enable the Client to demonstrate compliance with its obligations under the Data Protection Legislation, and allow for and contribute to audits, including inspections, conducted by the Client or an auditor mandated by the Client, to the extent that such information is within Company’s control and Company is not precluded from disclosing it by applicable law, a duty of confidentiality, or any other obligation owed to a third party. Client shall give Company reasonable prior notice of its intention to audit, conduct its audit during normal business hours, and take reasonable measures to prevent unnecessary disruption to Company’s operations. Client will be responsible for any fees charged by any auditor appointed by Client to execute any such audit.

Each party’s liability towards the other party under or in connection with this Addendum will be limited in accordance with the provisions of the Agreement.

For purposes of this Annex A, the terms “business”, “commercial purpose”, “service provider”, “sell” and “personal information” have the meanings given in the CCPA.

With respect to Client Personal Data, Instabug is a service provider under the CCPA.

The Company will not (a) sell Client Personal Data; (b) retain, use or disclose any Client Personal Data for any purpose other than for the specific purpose of providing the Services, including retaining, using or disclosing the Client Personal Data for a commercial purpose other than providing the Services; or (c) retain, use or disclose the Client Personal Data outside of the direct business relationship between the Company and the Client.

The parties acknowledge and agree that the Processing of Client Personal Data authorized by Client’s instructions described in Section 3 of this Addendum is integral to and encompassed by the Company provision of the Services and the direct business relationship between the parties.

Notwithstanding anything in the Agreement or any Order Form entered in connection therewith, the parties acknowledge and agree that the Company’s access to Client Personal Data does not constitute part of the consideration exchanged by the parties in respect of the Agreement.