UK DATA PROCESSING AGREEMENT

1.1 This Addendum applies exclusively to the processing of Customer Validation Data which is subject to the UK GDPR in the scope of the Terms and Conditions of Use Agreement of even date hereof between the Parties for the provision of the ZeroBounce services (“Services”) (hereinafter to be referred to as: the “Service Agreement”). The parties would like to rely on the European Commission’s Standard Contractual Clauses for international data transfers adopted by European Decision 914/2021/EU (“EU SCC”), and the UK International Data Protection Addendum for the transfer of personal data from the UK.

2.1 “UK GDPR” shall mean Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation), tailored by the Data Protection Act 2018.

2.2 “Applicable Data Protection Law” means the data protection law of the UK which is the UK GDPR and the Data Protection Act 2018, the Privacy and Electronic Communications (EC Directive) Regulations 2003 (as amended), and other data protection or privacy legislation in force from time to time in the United Kingdom;

2.3 Terms such as “Personal Data”, “Special Categories of Data”, “Process/Processing”, “Exporter”, “Importer”, “data subject”, “sub-processor,” and “technical and organisational security measures” shall have the same meaning ascribed to them in the UK GDPR.

2.4 “Standard Contractual Clauses” shall, based on the circumstances unique to the Exporter, mean the International Data Transfer Addendum to the EU Commission SCCs, promulgated by the IOC, attached hereto as Exhibit A.

3.1 Insofar as the Importer will be processing Personal Data subject to the UK GDPR on behalf of the Exporter in the course of the performance of the Service Agreement with the Exporter the terms of this Addendum shall apply. Unless the Exporter instructs otherwise, the Exporter will transfer Personal Data, namely, Customer Validation Data, to be processed by the Importer on computer servers located in the European Union. The categories of Personal Data to be processed are online identifiers and may include the following: first name; last name; gender; city; state; country; Internet Protocol (IP) Address information; and email addresses. The types of data subjects whose information will be processed are individuals, namely the Data Controller’s customers who have consented to the processing of their Personal Data. The purposes for which the Personal Data will be processed include: validation of email lists for deliverability; removal of known email complainers, abusers and spam traps from email address lists; deliverability toolkit services; and to perform any additional services requested by Exporter. Notwithstanding the foregoing, the Exporter understands and agrees that the Importer has personnel located in the United States that have the ability to access its Customer Registration Data.

4.1 The Exporter will determine the scope, purposes, and manner by which the Personal Data may be accessed or processed by the Importer. The Importer will process the Personal Data only as set forth in Exporter’s written instructions.

4.2 The Importer will only process the Personal Data on documented instructions of the Exporter in such manner as – and to the extent that – this is appropriate for the provision of the Services, except as required to comply with a legal obligation to which the Importer is subject. In such a case, the Importer shall inform the Exporter of that legal obligation before processing, unless that law explicitly prohibits the furnishing of such information to the Exporter. The Importer shall never process the Personal Data in a manner inconsistent with the Exporter’s documented instructions. The Importer shall immediately inform the Exporter if, in its opinion, an instruction infringes the UK GDPR.

4.3 The Parties have entered into a Service Agreement in order to benefit from the expertise of the Importer in securing and processing the Personal Data for the purposes set out in Section 3.1 above. The Importer shall be allowed to exercise its own discretion in the selection and use of such means as it considers necessary to pursue those purposes, subject to the requirements of this Addendum.

4.4 Exporter warrants that it has all necessary rights to provide the Personal Data to Importer for the Processing to be performed in relation to the Services. To the extent required by the UK GDPR, Exporter is responsible for ensuring that any necessary data subject consents to this Processing are obtained, and for ensuring that a record of such consents is maintained. Should such a consent be revoked by the data subject, Exporter is responsible for communicating the fact of such revocation to the Importer, and Importer remains responsible for implementing any Exporter instruction with respect to the further processing of that Personal Data.

5.1 Without prejudice to any existing contractual arrangements between the Parties, the Importer shall treat all Personal Data as strictly confidential and it shall inform all its employees, agents and/or approved sub-processors engaged in processing the Personal Data of the confidential nature of the Personal Data. The Importer shall ensure that all such persons or parties have signed an appropriate confidentiality agreement, are otherwise bound to a duty of confidentiality, or are under an appropriate statutory obligation of confidentiality.

6.1 Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, without prejudice to any other security standards agreed upon by the Parties, the Exporter and Importer shall implement appropriate technical and organizational measures to ensure a level of security of the processing of Personal Data appropriate to the risk. These measures shall include as appropriate:

ZeroBounce takes the following security measures and those described in Appendix 2, to protect Personal Data against accidental or unlawful destruction or accidental loss, alteration, unauthorized disclosure or access:

6.2 The Importer shall at all times have in place an appropriate written security policy with respect to the processing of Personal Data, outlining in any case the measures set forth in Paragraph 6.1.

6.3 At the request of the Exporter, the Importer, shall demonstrate the measures it has taken and shall allow the Exporter to audit and test such measures. The Exporter shall be entitled on giving at least 14 days notice to the Importer to carry out, or have carried out by a third party who has entered into a confidentiality agreement with the Importer, audits of the Importer’s premises and operations as these relate to the Personal Data. The Importer shall cooperate with such audits carried out by or on behalf of the Exporter and shall grant the Exporter’s auditors reasonable access to any premises and devices involved with the Processing of the Personal Data. The Importer shall provide the Exporter and/or the Exporter’s auditors with access to any information relating to the Processing of the Personal Data as may be reasonably required by the Exporter to ascertain the Importer’s compliance with this Addendum.

7.1 The Parties acknowledge that security requirements are constantly changing and that effective security requires frequent evaluation and regular improvements of outdated security measures. The Importer will therefore evaluate the measures as implemented in accordance with Paragraph 6.1 on an on-going basis and will tighten, supplement, and improve these measures in order to maintain compliance with the requirements set out in Paragraph 6.1. The Parties will negotiate in good faith the cost, if any, to implement material changes required by specific updated security requirements set forth in the UK GDPR or by data protection authorities of competent jurisdiction.

7.2 Where an amendment to the Service Agreement is necessary in order to execute an Exporter instruction to the Importer, or to improve security measures as may be required by changes in applicable data protection law from time to time, the Parties shall negotiate an amendment to the Service Agreement in good faith.

8.1 For the Services, unless otherwise specifically instructed by the Exporter, Exporter will transfer Personal Data to be processed by the Importer on computer servers located in the EU. The Importer shall not disclose Personal Data received hereunder to a third party or transfer it to a non-EU/European Economic Area (EEA) country without the Exporter’s authorization. The Importer shall immediately notify the Exporter of any (planned) permanent or temporary transfers of Personal Data to a country outside of the EU/EAA without an adequate level of protection and shall only perform such a (planned) transfer after obtaining authorization from the Exporter, which may be refused at its own discretion.

8.2 To the extent that the Exporter or the Importer are relying on a specific statutory mechanism to normalize international data transfers that is subsequently modified, revoke, or held in a court of competent jurisdiction to be invalid, the Exporter and the Importer agree to cooperate in good faith to promptly terminate the transfer or to pursue a suitable alternate mechanism that can lawfully support the transfer.

9.1 When the Importer becomes aware of an incident that impacts the Processing of the Personal Data that is the subject of the Service Agreement, it shall promptly notify the Exporter about the incident, shall at all times cooperate with the Exporter, and shall follow the Exporter’s instructions with regard to such incidents, in order to enable the Exporter to perform a thorough investigation into the incident, to formulate a correct response, and to take suitable further steps in respect of the incident.

9.2 The term “incident” used in Paragraph 9.1 shall be understood to mean in any case:

9.3 The Importer shall at all times have in place written procedures which enable it to promptly respond to the Exporter about an incident. Where an incident is reasonably likely to require a data breach notification by the Exporter under the UK GDPR, the Importer shall implement its written procedures in such a way that it is in a position to notify the Exporter no later than 24 hours of having become aware of such an incident.

9.4 Any notifications made to the Exporter pursuant to this Article shall be addressed to the Data Protection Officer or other employee of the Exporter whose contact details are provided during the registration process, and shall contain:

10.1 The Exporter authorizes the Importer to engage sub-processors in the country locations for the Service-related activities specified as described in Paragraph 3.1. Importer shall inform the Exporter of any addition or replacement of such sub-processors giving the Exporter an opportunity to object to such changes.

10.2 Notwithstanding any authorization by the Exporter with the meaning of the preceding paragraph, the Importer shall remain fully liable vis-à-vis the Exporter for the performance of any such sub-processor that fails to fulfill its data protection obligations.

10.3 The consent of the Exporter pursuant to Paragraph 10.1 shall not alter the fact that consent is required for the engagement of sub-processors in a country outside the European Economic Area without a suitable level of protection.

10.4 The Importer shall ensure that the sub-processor is bound by the same data protection obligations of the Importer under this Addendum, shall supervise compliance thereof, and must in particular impose on its sub-processors the obligation to implement appropriate technical and organizational measures in such a manner that the processing will meet the requirements of the UK GDPR.

10.5 The Exporter may request that the Importer audit a sub-processor or provide confirmation that such an audit has occurred (or, where available, obtain or assist customer in obtaining a third-party audit report concerning the sub-processor’s operations) to ensure compliance with its obligations imposed by the Importer in conforming with this Addendum.

11.1 Upon termination of the Service Agreement, upon the Exporter’s written request, or upon fulfillment of all purposes agreed in the context of the Services whereby no further processing is required, the Importer shall, at the discretion of the Exporter, either delete, destroy, or return all Personal Data to the Exporter and destroy or return any existing copies.

11.2 The Importer shall notify all third parties supporting its own processing of the Personal Data of the termination of the Service Agreement and shall ensure that all such third parties shall either destroy the Personal Data or return the Personal Data to the Exporter, at the discretion of the Exporter.

12.1 The Importer shall assist the Exporter by appropriate technical and organizational measures, insofar as this is possible, for the fulfillment of the Exporter’s obligation to respond to a request for exercising the data subject’s rights under the UK GDPR.

12.2 The Importer shall assist the Exporter in ensuring compliance with the obligations pursuant to Paragraph 6 (Security) and prior consultations with supervisory authorities required under Article 36 of the UK GDPR taking into account the nature of processing and the information available to the Importer.

12.3 The Importer shall make available to the Exporter all information necessary to demonstrate compliance with the Importer’s obligations and to allow for and contribute to audits, including inspections, conducted by the Exporter or another auditor mandated by the Exporter.

13.1 The Importer indemnifies the Exporter and holds the Exporter harmless against all claims, actions, third party claims, losses, damages and expenses incurred by the Exporter and arising directly or indirectly out of or in connection with a breach of this Addendum and/or the UK GDPR by the Importer. The Exporter indemnifies the Importer and holds the Importer harmless against all claims, actions, third party claims, losses, damages and expenses incurred by the Importer and arising directly or indirectly out of or in connection with a breach of this Addendum and/or the UK GDPR by the Exporter.

14.1 This Addendum shall come into effect on the date the Exporter signs this Addendum, which may be through electronic means.

14.2 Termination or expiration of the Service Agreement shall not discharge the Importer from its confidentiality obligations pursuant to Paragraph 5.

14.3 The Importer shall process Personal Data until the date of termination of the Service Agreement, unless instructed otherwise by the Exporter, or until such data is returned or destroyed on instruction of the Exporter.

15.1 In the event of any inconsistency between the provisions of this Addendum and the provisions of the Service Agreement, the provisions of this Addendum shall prevail.

a. together they operate for data transfers made by the Exporter to the Importer, to the extent that UK Data Protection Laws apply to the Exporter’s processing when making that data transfer, and they provide Appropriate Safeguards for those data transfers;

b. Sections 9 to 11 override Clause 5 (Hierarchy) of the Addendum EU SCCs; and

c. this Addendum (including the Addendum EU SCCs incorporated into it) is (1) governed by the laws of England and Wales and (2) any dispute arising from it is resolved by the courts of England and Wales, in each case unless the laws and/or courts of Scotland or Northern Ireland have been expressly selected by the Parties.

a. References to the “Clauses” means this Addendum, incorporating the Addendum EU SCCs;

b. In Clause 2, delete the words:
“and, with respect to data transfers from controllers to processors and/or processors to processors, standard contractual clauses pursuant to Article 28(7) of Regulation (EU) 2016/679”;

c. Clause 6 (Description of the transfer(s)) is replaced with:
“The details of the transfers(s) and in particular the categories of personal data that are transferred and the purpose(s) for which they are transferred) are those specified in Annex I.B where UK Data Protection Laws apply to the Exporter’s processing when making that transfer.”;

d. Clause 8.7(i) of Module 1 is replaced with:
“it is to a country benefitting from adequacy regulations pursuant to Section 17A of the UK GDPR that covers the onward transfer”;

e. Clause 8.8(i) of Modules 2 and 3 is replaced with:
“the onward transfer is to a country benefitting from adequacy regulations pursuant to Section 17A of the UK GDPR that covers the onward transfer;”

f. References to “Regulation (EU) 2016/679”, “Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation)” and “that Regulation” are all replaced by “UK Data Protection Laws”. References to specific Article(s) of “Regulation (EU) 2016/679” are replaced with the equivalent Article or Section of UK Data Protection Laws;

g. References to Regulation (EU) 2018/1725 are removed;

h. References to the “European Union”, “Union”, “EU”, “EU Member State”, “Member State” and “EU or Member State” are all replaced with the “UK”;

i. The reference to “Clause 12(c)(i)” at Clause 10(b)(i) of Module one, is replaced with “Clause 11(c)(i)”;

j. Clause 13(a) and Part C of Annex I are not used;

k. The “competent supervisory authority” and “supervisory authority” are both replaced with the “Information Commissioner”;

l. In Clause 16(e), subsection (i) is replaced with:
“the Secretary of State makes regulations pursuant to Section 17A of the Data Protection Act 2018 that cover the transfer of personal data to which these clauses apply;”;

m. Clause 17 is replaced with:
“These Clauses are governed by the laws of England and Wales.”;

n. Clause 18 is replaced with:
“Any dispute arising from these Clauses shall be resolved by the courts of England and Wales. A data subject may also bring legal proceedings against the Exporter and/or Importer before the courts of any country in the UK. The Parties agree to submit themselves to the jurisdiction of such courts.”; and

o. The footnotes to the Approved EU SCCs do not form part of the Addendum, except for footnotes 8, 9, 10 and 11.

a. makes reasonable and proportionate changes to the Approved Addendum, including correcting errors in the Approved Addendum; and/or

b. reflects changes to UK Data Protection Laws;

a. its direct costs of performing its obligations under the Addendum; and/or

b. its risk under the Addendum,