Data Processing Addendum

GAMMA TECH, INC.

THIS DATA PROCESSING ADDENDUM ("DPA") is entered into as of the Addendum Effective Date by and between: (1) Gamma Tech, Inc., a U.S. corporation with its principal business address at 2261 Market Street #4544, San Francisco, CA 94114 ("Gamma"); and (2) the entity or other person who is a counterparty to the Agreement (as defined below) into which this DPA is incorporated and forms a part ("Customer"), together the "Parties" and each a "Party".

1. INTERPRETATION

1.1In this DPA the following terms shall have the meanings set out in this Section 1, unless expressly stated otherwise:

• (a) "Addendum Effective Date" means the effective date of the Agreement.
• (b) "Agreement" means the agreement under which Gamma has agreed to provide the Services to Customer entered into by and between the Parties.
• (c) "Applicable Data Protection Laws" means the privacy, data protection and data security laws and regulations of any jurisdiction applicable to the Processing of Customer Personal Data under the Agreement, including, without limitation, the GDPR and State Privacy Laws (as and where applicable).
• (d) "Controller" means the entity that, alone or jointly with others, determines the purposes and means of the Processing of Personal Data.
• (e) "Customer Personal Data" means any Personal Data Processed by Gamma or its Sub-Processor on behalf of Customer to perform the Services under the Agreement.
• (f) "Data Subject Request" means the exercise by a Data Subject of its rights in accordance with Applicable Data Protection Laws in respect of Customer Personal Data and the Processing thereof.
• (g) "Data Subject" means the identified or identifiable natural person to whom Customer Personal Data relates.
• (h) "EEA" means the European Economic Area.
• (i) "GDPR" means, as and where applicable to Processing concerned: (i) the General Data Protection Regulation (Regulation (EU) 2016/679) ("EU GDPR"); and/or (ii) the EU GDPR as it forms part of UK law by virtue of section 3 of the European Union (Withdrawal) Act 2018 (as amended, including by the Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019) ("UK GDPR"), including, in each case (i) and (ii) any applicable national implementing or supplementary legislation (e.g., the UK Data Protection Act 2018), and any successor, amendment or re-enactment, to or of the foregoing. References to "Articles" and "Chapters" of, and other relevant defined terms in, the GDPR shall be construed accordingly.
• (j) "Personal Data" means "personal data," "personal information," "personally identifiable information" or similar term defined in Applicable Data Protection Laws.
• (k) "Personal Data Breach" means a breach of Gamma's security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data in Gamma's possession, custody or control. For clarity, Personal Data Breach does not include unsuccessful attempts or activities that do not compromise the security of Customer Personal Data (such as unsuccessful log-in attempts, pings, port scans, denial of service attacks, or other network attacks on firewalls or networked systems).
• (l) "Personnel" means a person's employees, agents, consultants, contractors, or other staff.
• (m) "Process" and inflection thereof means any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
• (n) "Processor" means the entity that Processes Personal Data on behalf of the Controller.
• (o) "Restricted Transfer" means the disclosure, grant of access or other transfer of Customer Personal Data to any person located in: (i) in the context of the EEA, any country or territory outside the EEA which does not benefit from an adequacy decision from the European Commission (an "EU Restricted Transfer"); and (ii) in the context of the UK, any country or territory outside the UK, which does not benefit from an adequacy decision from the UK Government (a "UK Restricted Transfer"), which would be prohibited without a legal basis under Chapter V of the GDPR.
• (p) "SCCs" means the standard contractual clauses approved by the European Commission pursuant to implementing Decision (EU) 2021/914.
• (q) "Service Data" means any data relating to the use, support and/or operation of the Services, which is collected directly by Gamma from and/or about users of the Services and/or Customer's use of the Service for use for its own purposes (certain of which may constitute Personal Data).
• (r) "Services" means those services and activities to be supplied to or carried out by or on behalf of Gamma for Customer pursuant to the Agreement.
• (s) "State Privacy Laws" means, collectively, the comprehensive state-specific data privacy laws as and to the extent applicable to Gamma's Processing of Customer Personal Data under the Agreement, including, without limitation, the California Consumer Privacy Act of 2018 ("CCPA").
• (t) "Sub-Processor" means any third party appointed by or on behalf of Gamma to Process Customer Personal Data.
• (u) "Supervisory Authority" means any entity with the authority to enforce Applicable Data Protection Laws, including, (i) in the context of the EEA and the EU GDPR, shall have the meaning given to that term in the EU GDPR; and (ii) in the context of the UK and the UK GDPR, means the UK Information Commissioner's Office.
• (v) "UK Transfer Addendum" means the template Addendum B.1.0 issued by the ICO and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022, as it is revised under Section 18 of the Mandatory Clauses included in Part 2 thereof (the "Mandatory Clauses").

1.2Unless otherwise defined in this DPA, all capitalised terms in this DPA shall have the meaning given to them in the Agreement.

2. SCOPE OF THIS DATA PROCESSING ADDENDUM

2.1The body of this DPA applies generally to Gamma's Processing of Customer Personal Data under the Agreement.

2.2Annex 2 (European Annex) to this DPA applies only if and to the extent Gamma's Processing of Customer Personal Data under the Agreement is subject to the GDPR.

2.3Annex 3 (State Privacy Laws Annex) to this DPA applies only if and to the extent Gamma's Processing of Customer Personal Data under the Agreement is subject to the State Privacy Laws.

3. PROCESSING OF CUSTOMER PERSONAL DATA

3.1Gamma shall not Process Customer Personal Data other than on Customer's instructions or as required by applicable laws.

3.2Customer instructs Gamma to Process Customer Personal Data as necessary to provide the Services to Customer under and in accordance with the Agreement.

3.3The Parties acknowledge and agree that the details of Gamma's Processing of Customer Personal Data (including the respective roles of the Parties relating to such Processing) are as described in Annex 1 (Data Processing Details) to the DPA.

4. GAMMA PERSONNEL

Gamma shall take commercially reasonable steps to ascertain the reliability of any Gamma Personnel who Process Customer Personal Data, and shall enter into written confidentiality agreements with all Gamma Personnel who Process Customer Personal Data that are not subject to professional or statutory obligations of confidentiality.

5. SECURITY

5.1Gamma shall implement and maintain technical and organisational measures in relation to Customer Personal Data designed to protect Customer Personal Data against Personal Data Breaches as described in Annex 4 (Security Measures) (the "Security Measures").

5.2Gamma may update the Security Measures from time to time, provided the updated measures do not materially decrease the overall protection of Customer Personal Data.

6. SUB-PROCESSING

6.1Customer generally authorises Gamma to appoint Sub-Processors in accordance with this Section 6.

6.2Gamma may continue to use those Sub-Processors already engaged by Gamma as at the date of this DPA (as those Sub-Processors are shown, together with their respective functions and locations, in the Sub-Processor list shown in Annex 5 (Authorized Sub-Processors) (the "Sub-Processor List").

6.3Gamma shall give Customer prior written notice of the appointment of any proposed Sub-Processor, including reasonable details of the Processing to be undertaken by the Sub-Processor, by providing Customer with an updated copy of the Sub-Processor List (including via a 'mailshot' or similar bulk distribution mechanism sent to Customer's contact point set out in Annex 1 (Data Processing Details)). If, within ten (10) days of receipt of that notice, Customer notifies Gamma in writing of any objections (on reasonable grounds) to the proposed appointment:

• (a) Gamma shall use reasonable efforts to make available a commercially reasonable change in the provision of the Services, which avoids the use of that proposed Sub-Processor; and
• (b) where: (i) such a change cannot be made within thirty (30) days from Gamma's receipt of Customer's notice; (ii) no commercially reasonable change is available; and/or (iii) Customer declines to bear the cost of the proposed change, then either Party may by written notice to the other Party with immediate effect terminate the Agreement, either in whole or to the extent that it relates to the Services which require the use of the proposed Sub-Processor, as its sole and exclusive remedy.

6.4If Customer does not object to Gamma's appointment of a Sub-Processor during the objection period referred to in Section 6.3, Customer shall be deemed to have approved the engagement and ongoing use of that Sub-Processor.

6.5With respect to each Sub-Processor, Gamma shall maintain a written contract between Gamma and the Sub-Processor that includes terms which offer a level of protection for Customer Personal Data substantially similar to those set out in this DPA (including the Security Measures). Gamma shall remain liable for any breach of this DPA caused by a Sub-Processor to the same extent as Gamma would have been had Gamma performed the Processing itself.

7. DATA SUBJECT RIGHTS

7.1Gamma, taking into account the nature of the Processing of Customer Personal Data, shall provide Customer with such assistance as may be reasonably necessary and technically feasible to assist Customer in fulfilling its obligations to respond to Data Subject Requests. If Gamma receives a Data Subject Request, Customer will be responsible for responding to any such request.

7.2Gamma shall:

• (a) promptly notify Customer if it receives a Data Subject Request; and
• (b) not respond to any Data Subject Request, other than to advise the Data Subject to submit the request to Customer, except on the written instructions of Customer or as required by Applicable Data Protection Laws.

7.3Except to the extent prohibited by applicable law, Customer shall be fully responsible for all time spent by Gamma (at Gamma's then-current professional services rates) in Gamma's cooperation and assistance provided to Customer under this Section 7, and shall on demand reimburse Gamma any such costs incurred by Gamma.

8. PERSONAL DATA BREACH

Breach notification and assistance

8.1Gamma shall notify Customer without undue delay upon Gamma's discovering a Personal Data Breach affecting Customer Personal Data. Gamma shall provide Customer with information (insofar as such information is within Gamma's possession and knowledge and does not otherwise compromise the security of any Personal Data Processed by Gamma) to allow Customer to meet its obligations under the Applicable Data Protection Laws to report the Personal Data Breach. Gamma's notification of or response to a Personal Data Breach shall not be construed as Gamma's acknowledgement of any fault or liability with respect to the Personal Data Breach.

8.2Gamma shall reasonably co-operate with Customer and take such commercially reasonable steps as may be directed by Customer to assist in the investigation of any such Personal Data Breach.

8.3Customer is solely responsible for complying with notification laws applicable to Customer and fulfilling any third-party notification obligations related to any Personal Data Breaches.

Notification to Gamma

8.4If Customer determines that a Personal Data Breach must be notified to any Supervisory Authority, any Data Subject(s), the public or others under Applicable Data Protection Laws, to the extent such notice directly or indirectly refers to or identifies Gamma, where permitted by applicable laws, Customer agrees to:

• (a) notify Gamma in advance; and
• (b) in good faith, consult with Gamma and consider any clarifications or corrections Gamma may reasonably recommend or request to any such notification, which: (i) relate to Gamma's involvement in or relevance to such Personal Data Breach; and (ii) are consistent with applicable laws.

9. RETURN AND DELETION

9.1Subject to Sections 9.2 and 9.3, upon the date of cessation of any Services involving the Processing of Customer Personal Data (the "Cessation Date"), Gamma shall promptly cease all Processing of Customer Personal Data for any purpose other than for storage or as otherwise permitted or required under this DPA.

9.2Subject to Sections 9.4 and 9.5, to the extent technically possible in the circumstances (as determined in Gamma's sole discretion), on written request to Gamma (to be made no later than fourteen (14) days after the Cessation Date ("Post-cessation Storage Period")), Gamma shall within fourteen (14) days of such request:

• (a) return a complete copy of all Customer Personal Data within Gamma's possession to Customer by secure file transfer, promptly following which Gamma shall delete or irreversibly anonymise all other copies of such Customer Personal Data; or
• (b) either (at its option) delete or irreversibly anonymise all Customer Personal Data within Gamma's possession.

9.3In the event that during the Post-cessation Storage Period, Customer does not instruct Gamma in writing to either delete or return Customer Personal Data pursuant to Section 9.2, Gamma shall promptly after the expiry of the Post-cessation Storage Period either (at its option) delete; or irreversibly render anonymous, all Customer Personal Data then within Gamma possession to the fullest extent technically possible in the circumstances.

9.4To the extent that deletion of any Customer Personal Data contained in any back-ups' maintained by or on behalf of Gamma is not technically feasible within the timeframe set out in Customer's instructions, Gamma shall:

• (a) securely delete such Customer Personal Data in accordance with any relevant scheduled back-up deletion routines (e.g., those contained within Gamma's relevant business continuity and disaster recovery procedures); and
• (b) pending such deletion, put such Customer Personal Data beyond use.

9.5Gamma may retain Customer Personal Data where permitted or required by applicable law, for such period as may be required by such applicable law, provided that Gamma shall:

• (a) maintain the confidentiality of all such Customer Personal Data; and
• (b) Process the Customer Personal Data only as necessary for the purpose(s) specified in the applicable law permitting or requiring such retention.

10. AUDIT RIGHTS

10.1Gamma shall make available to Customer on request, such information as Gamma (acting reasonably) considers appropriate in the circumstances to demonstrate its compliance with this DPA and Applicable Data Protection Laws.

10.2Subject to Sections 10.3 to 10.8, in the event that Customer (acting reasonably) is able to provide documentary evidence that the information made available by Gamma pursuant to Section 10.1 is not sufficient in the circumstances to demonstrate Gamma's compliance with this DPA, Gamma shall allow for and contribute to audits, including on-premise inspections, by Customer or an auditor mandated by Customer in relation to the Processing of Customer Personal Data by Gamma.

10.3Customer shall give Gamma reasonable notice of any audit or inspection to be conducted under Section 10.2 (which shall in no event be less than fourteen (14) days' notice) and shall use its best efforts (and ensure that each of its mandated auditors uses its best efforts) to avoid causing any destruction, damage, injury or disruption to Gamma's premises, equipment, Personnel, data, and business (including any interference with the confidentiality or security of the data of Gamma's other customers or the availability of Gamma's services to such other customers).

10.4Prior to conducting any audit, Customer must submit a detailed proposed audit plan providing for the confidential treatment of all information exchanged in connection with the audit and any reports regarding the results or findings thereof. The proposed audit plan must describe the proposed scope, duration, and start date of the audit. Gamma will review the proposed audit plan and provide Customer with any concerns or questions (for example, any request for information that could compromise Gamma security, privacy, employment or other relevant policies). Gamma will work cooperatively with Customer to agree on a final audit plan.

10.5If the controls or measures to be assessed in the requested audit are addressed in a SOC 2 Type 2, ISO, NIST or similar audit report performed by a qualified third-party auditor within twelve (12) months of Customer's audit request ("Audit Report") and Gamma has confirmed in writing that there are no known material changes in the controls audited and covered by such Audit Report(s), Customer agrees to accept provision of such Audit Report(s) in lieu of requesting an audit of such controls or measures.

10.6Gamma need not give access to its premises for the purposes of such an audit or inspection:

• (a) where an Audit Report is accepted in lieu of such controls or measures in accordance with Section 10.5;
• (b) to any individual unless they produce reasonable evidence of their identity;
• (c) to any auditor whom Gamma has not approved in advance (acting reasonably);
• (d) to any individual who has not entered into a non-disclosure agreement with Gamma on terms acceptable to Gamma;
• (e) outside normal business hours at those premises; or
• (f) on more than one occasion in any calendar year during the term of the Agreement, except for any audits or inspections which Customer is required to carry out under Applicable Data Protection Laws or by a Supervisory Authority.

10.7Nothing in this DPA shall require Gamma to furnish more information about its Sub-Processors in connection with such audits than such Sub-Processors make generally available to their customers.

10.8Nothing in this Section 10 shall be construed to obligate Gamma to breach any duty of confidentiality.

10.9Except to the extent prohibited by applicable law, Customer shall be fully responsible for all time spent by Gamma (at Gamma's then-current professional services rates) in Gamma's provision of any cooperation and assistance provided to Customer under this Section 10 (excluding any costs incurred in the procurement, preparation or delivery of Audit Reports to Customer pursuant to Section 10.5), and shall on demand reimburse Gamma any such costs incurred by Gamma.

11. CUSTOMER'S RESPONSIBILITIES

11.1Customer agrees that, without limiting Gamma's obligations under Section 5 (Security), Customer is solely responsible for its use of the Services, including (a) making appropriate use of the Services to maintain a level of security appropriate to the risk in respect of the Customer Personal Data; (b) securing the account authentication credentials, systems and devices Customer uses to access the Services; (c) securing Customer's systems and devices that Gamma uses to provide the Services; and (d) backing up Customer Personal Data.

11.2Customer shall ensure:

• (a) that there is, and will be throughout the term of the Agreement, a valid legal basis for the Processing by Gamma of Customer Personal Data in accordance with this DPA and the Agreement (including, any and all instructions issued by Customer from time to time in respect of such Processing) for the purposes of all Applicable Data Protection Laws (including Article 6, Article 9(2) and/or Article 10 of the GDPR (where applicable)); and
• (b) that all Data Subjects have (i) been presented with all required notices and statements (including as required by Article 12-14 of the GDPR (where applicable)); and (ii) provided all required consents, in each case (i) and (ii) relating to the Processing by Gamma of Customer Personal Data.

11.3Customer agrees that the Service, the Security Measures, and Gamma's commitments under this DPA are adequate to meet Customer's needs, including with respect to any security obligations of Customer under Applicable Data Protection Laws, and provide a level of security appropriate to the risk in respect of the Customer Personal Data.

11.4Customer shall not provide or otherwise make available to Gamma any Customer Personal Data that contains any (a) Social Security numbers or other government-issued identification numbers; (b) protected health information subject to the Health Insurance Portability and Accountability Act (HIPAA) or other information regarding an individual's medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional; (c) health insurance information; (d) biometric information; (e) passwords to any online accounts; (f) credentials to any financial accounts; (g) tax return data; (h) any payment card information subject to the Payment Card Industry Data Security Standard; (i) Personal Data of children under 13 years of age; or (j) any other information that falls within any special categories of personal data (as defined in GDPR) and/or data relating to criminal convictions and offences or related security measures (together, "Restricted Data").

12. LIABILITY

The total aggregate liability of either Party towards the other Party, howsoever arising, under or in connection with this DPA and the SCCs (if and as they apply) will under no circumstances exceed any limitations or caps on, and shall be subject to any exclusions of, liability and loss agreed by the Parties in the Agreement; provided that, nothing in this Section 12 will affect any person's liability to Data Subjects under the third-party beneficiary provisions of the SCCs (if and as they apply).

13. SERVICE DATA

13.1Customer acknowledges that Gamma may collect, use and disclose Service Data for its own business purposes, such as:

• (a) for accounting, tax, billing, audit, and compliance purposes;
• (b) to investigate fraud, spam, wrongful or unlawful use of the Services; and/or
• (c) as otherwise permitted or required by applicable law.

13.2In respect of any such Processing described in Section 13.1, Gamma:

• (a) independently determines the purposes and means of such Processing;
• (b) shall comply with Applicable Data Protection Laws (if and as applicable in the context);
• (c) shall Process such Service Data as described in Gamma's relevant privacy notices/policies, as updated from time to time; and
• (d) where possible, shall apply technical and organisational safeguards to any relevant Personal Data that are no less protective than the Security Measures.

13.3For the avoidance of doubt, this DPA shall not apply to Gamma collection, use, disclosure or other Processing of Service Data, and Service Data does not constitute Customer Personal Data.

14. CHANGE IN LAWS

Gamma may on notice vary this DPA to the extent that (acting reasonably) it considers necessary to address the requirements of Applicable Data Protection Laws from time to time, including by varying or replacing the SCCs in the manner described in Paragraph 3.3 of Annex 2 (European Annex).

15. INCORPORATION AND PRECEDENCE

15.1This DPA shall be incorporated into and form part of the Agreement with effect from the Addendum Effective Date.

15.2In the event of any conflict or inconsistency between:

• (a) this DPA and the Agreement, this DPA shall prevail; or
• (b) any SCCs entered into pursuant to Paragraph 3 of Annex 2 (European Annex) and this DPA and/or the Agreement, the SCCs shall prevail in respect of the Restricted Transfer to which they apply.

1. PROCESSING OF CUSTOMER PERSONAL DATA

1.1Where Gamma receives an instruction from Customer that, in its reasonable opinion, infringes the GDPR, Gamma shall inform Customer.

1.2Customer acknowledges and agrees that any instructions issued by Customer with regards to the Processing of Customer Personal Data by or on behalf of Gamma pursuant to or in connection with the Agreement shall be in strict compliance with the GDPR and all other applicable laws.

2. DATA PROTECTION IMPACT ASSESSMENT AND PRIOR CONSULTATION

2.1Gamma, taking into account the nature of the Processing and the information available to Gamma, shall provide reasonable assistance to Customer, at Customer's cost, with any data protection impact assessments and prior consultations with Supervisory Authorities which Customer reasonably considers to be required of it by Article 35 or Article 36 of the GDPR, in each case solely in relation to Processing of Customer Personal Data by Gamma.

2.2Except to the extent prohibited by applicable law, Customer shall be fully responsible for all time spent by Gamma (at Gamma's then-current professional services rates) in Gamma's provision of any cooperation and assistance provided to Customer under Paragraph 2.1, and shall on demand reimburse Gamma any such costs incurred by Gamma.

3. RESTRICTED TRANSFERS

EU Restricted Transfers

3.1To the extent that any Processing of Customer Personal Data under this DPA involves an EU Restricted Transfer from Customer to Gamma, the Parties shall comply with their respective obligations set out in the SCCs, which are hereby deemed to be:

• (a) populated in accordance with Part 1 of Attachment 1 to Annex 2 (European Annex); and
• (b) entered into by the Parties and incorporated by reference into this DPA.

UK Restricted Transfers

3.2To the extent that any Processing of Customer Personal Data under this DPA involves a UK Restricted Transfer from Customer to Gamma, the Parties shall comply with their respective obligations set out in the SCCs, which are hereby deemed to be:

• (a) varied to address the requirements of the UK GDPR in accordance with UK Transfer Addendum and populated in accordance with Part 2 of Attachment 1 to Annex 2 (European Annex); and
• (b) entered into by the Parties and incorporated by reference into this DPA.

Adoption of new transfer mechanism

3.3Gamma may on notice vary this DPA and replace the relevant SCCs with:

• (a) any new form of the relevant SCCs or any replacement therefor prepared and populated accordingly (e.g., standard data protection clauses adopted by the European Commission for use specifically in respect of transfers to data importers subject to Article 3(2) of the EU GDPR); or
• (b) another transfer mechanism, other than the SCCs, that enables the lawful transfer of Customer Personal Data to Gamma under this DPA in compliance with Chapter V of the GDPR.

Provision of full-form SCCs

3.4In respect of any given Restricted Transfer, if requested of Customer by a Supervisory Authority, Data Subject or further Controller (where applicable) — on specific written request (made to the contact details set out in Annex 1 (Data Processing Details); accompanied by suitable supporting evidence of the relevant request), Gamma shall provide Customer with an executed version of the relevant set(s) of SCCs responsive to the request made of Customer (amended and populated in accordance with Attachment 1 to Annex 2 (European Annex) in respect of the relevant Restricted Transfer) for countersignature by Customer, onward provision to the relevant requestor and/or storage to evidence Customer's compliance with Applicable Data Protection Laws.

Operational clarifications

3.5When complying with its transparency obligations under Clause 8.3 of the SCCs, Customer agrees that it shall not provide or otherwise make available, and shall take all appropriate steps to protect, Gamma's and its licensors' trade secrets, business secrets, confidential information and/or other commercially sensitive information.

3.6Where applicable, for the purposes of Clause 10(a) of Module Three of the SCCs, Customer acknowledges and agrees that there are no circumstances in which it would be appropriate for Gamma to notify any third-party controller of any Data Subject Request and that any such notification shall be the sole responsibility of Customer.

3.7For the purposes of Clause 15.1(a) of the SCCs, except to the extent prohibited by applicable law and/or the relevant public authority, as between the Parties, Customer agrees that it shall be solely responsible for making any notifications to relevant Data Subject(s) if and as required.

3.8The terms and conditions of Section 6 of the DPA apply in relation to Gamma's appointment and use of Sub-Processors under the SCCs. Any approval by Customer of Gamma's appointment of a Sub-Processor that is given expressly or deemed given pursuant to that Section 6 constitutes Customer's documented instructions to effect disclosures and onward transfers to any relevant Sub-Processors if and as required under Clause 8.8 of the SCCs.

3.9The audits described in Clauses 8.9(c) and 8.9(d) of the SCCs shall be subject to any relevant terms and conditions detailed in Section 10 of the DPA.

3.10Certification of deletion of Personal Data as described in Clauses 8.5 and 16(d) of the SCCs shall be provided only upon Customer's written request.

1. Definitions

In this Annex, the terms "business," "business purpose," "commercial purpose," "consumer," "sell," "share," and "service provider" shall have the respective meanings given thereto in the CCPA; and "personal information" shall mean Customer Data that constitutes "personal information" as defined in and that is subject to the State Privacy Laws.

2. Gamma's Obligations

2.1The business purposes and services for which Gamma is Processing personal information are for Gamma to provide the services to and on behalf of Customer as set forth in the Agreement, as described in more detail in Annex 1 (Data Processing Details) to the DPA.

2.2It is the Parties' intent that with respect to any personal information, Gamma is a service provider. Gamma (a) acknowledges that personal information is disclosed by Customer only for limited and specific purposes described in the Agreement; (b) shall comply with applicable obligations under the State Privacy Laws and shall provide the same level of privacy protection to personal information as is required by the State Privacy Laws; (c) agrees that Customer has the right to take reasonable and appropriate steps under and subject to Section 10 (Audit Rights) of the DPA to help ensure that Gamma's use of personal information is consistent with Customer's obligations under the State Privacy Laws; (d) shall notify Customer in writing of any determination made by Gamma that it can no longer meet its obligations under the State Privacy Laws; and (e) agrees that Customer has the right, upon notice, including pursuant to the preceding clause, to take reasonable and appropriate steps to stop and remediate unauthorized use of personal information.

2.3Gamma shall not (a) sell or share any personal information; (b) retain, use or disclose any personal information for any purpose other than for the business purposes specified in the Agreement, including retaining, using, or disclosing the personal information for a commercial purpose other than the business purpose specified in the Agreement, or as otherwise permitted by State Privacy Laws; (c) retain, use or disclose the personal information outside of the direct business relationship between Gamma and Customer; or (d) combine personal information received pursuant to the Agreement with personal information (i) received from or on behalf of another person, or (ii) collected from Gamma's own interaction with any consumer to whom such personal information pertains except as and to the extent necessary as a part of Gamma's provision of the Services. Gamma hereby certifies that it understands its obligations under this Section 2.3 and will comply with them.

2.4Gamma shall implement reasonable security procedures and practices appropriate to the nature of the personal information received from, or on behalf of, Customer, in accordance with Section 5 (Security) and Annex 4 (Security Measures) of the DPA.

2.5When Gamma engages any Sub-Processor, Gamma shall notify Customer of such Sub-Processor engagements in accordance with Section 6 (Sub-Processing) of the DPA and such notice shall satisfy Gamma's obligation under the State Privacy Laws to give notice of and an opportunity to object to such engagements.

2.6Gamma agrees that Customer may conduct audits, in accordance with Section 10 of the DPA (Audit Rights), to help ensure that Gamma's use of personal information is consistent with Gamma's obligations under the State Privacy Laws.

2.7The parties acknowledge that Gamma's retention, use and disclosure of personal information authorized by Customer's instructions documented in the Agreement and DPA are integral to Gamma's provision of the Services and the business relationship between the Parties.

As from the Addendum Effective Date, Gamma will implement and maintain the Security Measures as set out in this Annex 4.

• 1. Organisational management and staff responsible for the development, implementation and maintenance of Gamma's information security program.
• 2. Audit and risk assessment procedures for the purposes of periodic review and assessment of risks to Gamma's organisation, monitoring and maintaining compliance with Gamma's policies and procedures, and reporting the condition of its information security and compliance to internal senior management.
• 3. Data security controls which include at a minimum logical segregation of data, restricted (e.g. role-based) access and monitoring, and utilisation of commercially available and industry standard encryption technologies for Customer Personal Data.
• 4. Logical access controls designed to manage electronic access to data and system functionality based on authority levels and job functions.
• 5. Password controls designed to manage and control password strength, expiration and usage.
• 6. System audit or event logging and related monitoring procedures to proactively record user access and system activity.
• 7. Physical and environmental security of production resources relevant to the Services is maintained by the relevant Sub-Processor(s) (and their vendors) engaged from time-to-time by Gamma to host those resources. Gamma takes steps to ensure that such Sub Processors provide appropriate assurances and certifications that evidence such physical and environmental security – including security of data centre, server room facilities and other areas containing Customer Personal Data designed to:
  • a. protect information assets from unauthorised physical access,
  • b. manage, monitor and log movement into and out of Sub-Processor facilities, and
  • c. guard against environmental hazards such as heat, fire and water damage.
• 8. Operational procedures and controls to provide for configuration, monitoring and maintenance of technology and information systems, including secure disposal of systems and media to render all information or data contained therein as undecipherable or unrecoverable prior to final disposal or release from Gamma's possession.
• 9. Change management procedures and tracking mechanisms designed to test, approve and monitor all material changes to Gamma's technology and information assets.
• 10. Incident management procedures designed to allow Gamma to investigate, respond to, mitigate and notify of events related to Gamma's technology and information assets.
• 11. Network security controls that provide for the use of enterprise firewalls and intrusion detection systems designed to protect systems from intrusion and limit the scope of any successful attack.
• 12. Vulnerability assessment and threat protection technologies and scheduled monitoring procedures designed to identify, assess, mitigate and protect against identified security threats, viruses and other malicious code.
• 13. Business resiliency/continuity and disaster recovery procedures designed to maintain service and/or recovery from foreseeable emergency situations or disasters.

Gamma may freely update or modify these Security Measures from time to time provided that such updates and modifications do not materially decrease the overall security of Services and/or relevant Customer Personal Data.