p3

 

4.3 Limitation of Access

CP shall ensure that CP’s access to Personal Data is limited to those personnel of CP or Connfido Group performing Services in accordance with the Agreement.

4.4 Data Protection Officer

Members of the Connfido Group have appointed a data protection officer. The appointed person may be reached at support@celerispay.com .

5. Sub-Processors

5.1 Appointment of Sub-processors

Client acknowledges and agrees that:

• Entities within the Connfido Group may be retained as Sub-processors pursuant their involved in the delivery of the Services under the Agreement.
• CP and the Connfido Group respectively may engage third-party Sub-processors in connection with the provision of the Services. CP or a Connfido Group member has entered into a written agreement with each Sub-processor containing data protection
  obligations not less protective than those in this Agreement with respect to the protection of Customer Data to the extent applicable to the nature of the Services provided by such Sub-processor.

5.2 Objection Right for New Sub-processors

Client may object to CP’s use of a new Sub- processor by notifying CP promptly in writing within ten (10) business days after receipt of CP’s notice in accordance with the mechanism set out in Section 5.2. In the event Client objects to a new Sub-processor,
as permitted in the preceding sentence, CP will use reasonable efforts to make available to Client a change in the Services or recommend a commercially reasonable change to Client’s configuration or use of the Services to avoid Processing of Personal
Data by the objected-to new Sub-processor without unreasonably burdening the Client. If CP is unable to make available such change within a reasonable period of time, which shall not exceed thirty (30) days, Client may terminate the applicable
Order Form(s) with respect only to those Services, which cannot be provided by CP without the use of the objected-to new Sub-processor by providing written notice to CP.

5.3 Liability

CP shall be liable for the acts and omissions of its Sub-processors to the same extent CP would be liable if performing the services of each Sub-processor directly under the terms of this DPA, except as otherwise set forth in the CP’s Merchant Service
Agreement.

6. Security

6.1 Controls for the Protection of Customer Data

CP shall maintain appropriate technical and organizational measures for protection of the security, confidentiality, and integrity of Customer Data. These measures include protection against unauthorized or unlawful Processing, accidental or unlawful
destruction, loss, alteration, or damage, unauthorized disclosure of, or access to, Customer Data. CP regularly monitors compliance with these measures and will not materially decrease the overall security of the Services during a subscription
term.

6.2 Third-Party Certifications and Audits

Connfido Group has obtained the third-party certifications and audits set forth in the Security, Privacy and Architecture Documentation. Upon Client’s written request at reasonable intervals, and subject to the confidentiality obligations set forth
in the Agreement, Connfido Group shall make available to Client that is not a competitor of Connfido Group (or Client’s independent, third-party auditor that is not a competitor of Connfido Group) a copy of Connfido’s Group then most recent third-party
audits or certifications, as applicable