DATA PROTECTION ADDENDUM
(“Reseller”)

This Data Protection Addendum (“DPA”) forms part of the Reseller Agreement between Aryaka and Reseller (the “Agreement”) under which Reseller markets and resells Aryaka Services to their customers and potential customers. Capitalized terms used but not defined in this DPA shall have the meaning as set forth in the Agreement.

• 1. DEFINITIONS
• 1.1 “Data Controller” means the entity which, alone, jointly with others or as a Co-Data Controller, determines the purposes and means of Processing of Personal Information.
• 1.2 “Data Processor” means the entity which Processes Personal Information on behalf of the Data Controller.
• 1.3 “Data Protection Laws” mean all laws applicable to the Processing of Personal Information.
• 1.4 “Data Subject” means any individual about whom Personal Information may be Processed under this DPA.
• 1.5 “Personal Information” or “Personal Data” means Personal Data that relates to an identified or identifiable natural person that is provided to a Party pursuant to the Agreement.
• 1.6 “Process” or “Processing” means any operation or set of operations performed on Personal Information or on sets of Personal Information, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaption or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction of Personal Information.
• 1.7 “Security Incident” means a breach of security of the Services leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or unauthorized access to, Personal Information transmitted, stored or otherwise Processed under this DPA.
• 2. Relationship between the Parties. The Parties acknowledge that Reseller and Aryaka are each a Controller for purposes of the Agreement. In order to fulfill the Agreement, the Parties must provide limited Personal Information to each other, such as business contact information. The Parties will Process such Personal Information in accordance with the Agreement and this DPA or otherwise as required by applicable Data Protection Laws. From time to time, as contemplated in the Agreement, Reseller may provide Aryaka with information about its customers in order to facilitate Reseller’s provision of services to those customers. In those instances, Aryaka will only Process Personal Information about Reseller’s customers on the documented instructions of Reseller. Each Party will be solely responsible for complying with its obligations under applicable Data Protection Laws with respect to the Processing of Personal Information, including for providing any necessary notices to, and obtaining any necessary consents from, Data Subjects or other individuals with respect to the Processing of Personal Information. For clarity, Aryaka will not retain, use, or disclose Personal Information for any purpose other than providing Services to Reseller in accordance with the Agreement, including without limitation for any commercial purpose other than providing such Services to Reseller, or as required by applicable Data Protection Laws. Without limiting the foregoing, in no event will Aryaka sell or share such Personal Information to any third party. Aryaka certifies that it understands and will comply with the foregoing restrictions. Should Aryaka determines that it can no longer meet its obligations under applicable Data Protection Laws, it will promptly inform Reseller.
• 3. Co-Controllers. When the parties are acting as Co-Data Controllers, each party is an independent Data Controller and shall be individually and separately responsible for complying with the obligations that apply to it as a Data Controller under the Data Protection Laws. When acting as a Co-Controller, each party will individually determine the purposes and means of its Processing of Personal Data.
• 4. Confidentiality. The parties will require their personnel to protect the confidentiality of Personal Information.
• 5. Security. Both parties will maintain reasonable administrative, physical and technical safeguards designed to protect the security, confidentiality and integrity of Personal Data in or on the Aryaka Network against unauthorized loss, destruction, alteration, access, or disclosure, including the measures listed in Appendix 2.
• 6. Security Incident. If a security incident is experienced by either party that compromises Personal Information, the party experiencing the security incident will notify the other party without undue delay, and in any event within forty-eight (48) hours, unless otherwise prohibited by law or otherwise instructed by a law enforcement or supervisory authority. Considering the nature of the processing and the information available about the security incident, the party experiencing the security incident will upon the reasonable request of the other party provide reasonable assistance and cooperation to the other party with respect to any notifications that party is legally required to provide to affected Data Subjects or regulators with respect to such a Security Incident. The parties reserve the right to charge a reasonable fee to the other party for such requested assistance, to the extent permitted by applicable law.
• 7. Data Subject Requests. Given the nature of the Agreement, the parties agree that Reseller is the appropriate party to respond to Data Subject Requests. Aryaka will promptly notify Reseller, unless prohibited by applicable law, if Aryaka receives: (i) any requests from a Data Subject with respect to Personal Information Processed by Aryaka, including but not limited to opt-out requests, requests for access and/or rectification, blocking, erasure, requests for data portability, and all similar requests, and will not respond to any such requests unless expressly authorized to do so by Reseller; or (ii) any complaint relating to the Processing by Aryaka of Personal Information, including allegations that such Processing infringes on a Data Subject’s rights. Reseller is responsible for responding to Data Subject requests. At Reseller’s request and taking into account the nature of the processing, Aryaka will assist Reseller by appropriate technical and organizational measures, insofar as this is possible, for the fulfilment of obligations Reseller may have under applicable Data Protection Laws to respond to such Data Subject requests. Aryaka reserves the right to charge a reasonable fee to Reseller for such requested assistance, to the extent permitted by applicable law.
• 8. Subprocessors. Both parties agree that the other party may disclose Personal Information to its Processors and subcontractors for purposes of providing Services under the Agreement (“Subprocessors”), provided that both parties will impose substantially similar obligations on its Subprocessors regarding the security and confidentiality of Personal Information as those set forth in this DPA. Upon request, both parties will (a) make available a list of its Subprocessors and provide a mechanism to receive notice of any changes to this list. Both parties will be liable for the acts or omissions of any Subprocessors to the same extent as if the acts or omissions were performed by the entity that hired the Subprocessor.
• 9. Data Location. In connection with the performance of the Agreement, either party may transfer Personal Information to various locations, which may include locations both inside and outside of the United Kingdom (“UK”), European Economic Area (“EEA”) or Switzerland. To the extent such transfer involves a transfer of Personal Information originating in the UK, EEA or Switzerland to a location in countries outside the UK, EEA or Switzerland that have not received a binding adequacy decision, the Parties agree that when the parties are acting as Co-Controllers, the European Union Standard Contractual Clauses (Controller to Controller), attached here to at Appendix 1, will apply to such transfer, and such transfer is described in Annex 1. Where the relationship between the parties is that of Controller to Processor, the European Union Standard Contractual Clauses (Controller to Processor), attached hereto at Appendix 2, will apply to such transfer, and such transfer is described in Annex 1.
• 10. Audit. Upon either party’s request, the other party will make available up to once per year (a) a copy of a third-party assessment, such as a Service Organization Controls 1, Type 2 report or comparable report (“Third-Party Report”) , if such Third-Party Report was obtained or (b) if the party has not obtained a Third-Party Report, it will provide responses to any written questions reasonably submitted for purposes of verifying compliance with this Agreement (“Written Responses”) . Any such Third-Party Reports and Written Responses will be the submitting party’s confidential information and may not be disclosed without that party’s prior written consent, except as required by law. If a party responds to the other party’s request by providing Written Responses rather than a Third-Party Report, and the requesting party reasonably determines following receipt of the Written Reponses that further assessment is required by law, the requesting may request upon 30 days’ prior notice to perform a review at that party’s own expense, with a scope to be mutually agreed by the parties, of relevant policies, procedures, and related documentation of the Services, to the extent that such review does not compromise confidentiality obligations to any of Aryaka’s other Resellers. Reseller shall have the right to stop and take reasonable steps to remediate any unauthorized use of Personal information.
• 11. Return or Disposal. Upon request at the conclusion of the Agreement, either party will promptly delete Personal Data from its systems, unless applicable law requires storage of the Personal Data.