p2

2. Processing of Personal Data

2.1 Roles of the Parties

The parties acknowledge and agree that with regard to the Processing of Personal Data, Client is the Controller, CP is the Processor, and that CP will engage Sub-processors pursuant to the requirements set forth in Section 5 “Sub-processors” below.

2.2 Client’s Processing of Personal Data

Client shall, in its use of the Services, Process Personal Data in accordance with the requirements of Data Protection Laws and Regulations. For the avoidance of doubt, Client’s instructions for the Processing of Personal Data shall comply with Data
Protection Laws and Regulations. Client shall have sole responsibility for the accuracy, quality, and legality of Personal Data and the means by which Client acquired Personal Data.

2.3 CP’s Processing of Personal Data

CP shall treat Personal Data as Confidential Information and shall only Process Personal Data on behalf of and in accordance with Client’s documented instructions for the following purposes:

• Processing in accordance with the Agreement and applicable Order Form(s);
• Processing initiated by Users in their use of the Services;
• Processing to comply with other documented reasonable instructions provided by Client (e.g., via email) where such instructions are consistent with the terms of the Agreement.

2.4 Details of the Processing

The subject-matter of Processing of Personal Data by CP is the performance of the Services pursuant to the Agreement. The duration of the Processing, the nature and purpose of the Processing, the types of Personal Data, and categories of Data Subjects
Processed under this DPA are further specified in Annex 1 (Details of the Processing) to this DPA.

3. Rights of Data Subjects

Data Subject Request

CP shall, to the extent legally permitted, promptly notify Client if CP receives a request from a Data Subject to exercise the Data Subject’s right of access, right to rectification, restriction of Processing, erasure (“right to be forgotten”), data
portability, object to the Processing, or its right not to be subject to automated individual decision-making (“Data Subject Request”).

Taking into account the nature of the Processing, CP shall assist Client by appropriate technical and organizational measures, insofar as this is possible, for the fulfilment of Client’s obligation to respond to a Data Subject Request under Data Protection
Laws and Regulations.

4. CP Personnel

4.1 Confidentiality

CP shall ensure that its (or Connfido Group’s) personnel engaged in the Processing of Personal Data are informed of the confidential nature of the Personal Data, have received appropriate training on their responsibilities and have executed written
confidentiality agreements. CP shall ensure that such confidentiality obligations survive the termination of the personnel engagement.

4.2 Reliability

CP shall take commercially reasonable steps to ensure the reliability of any CP(or Connfido Group’s) personnel engaged in the Processing of Personal Data.