p5

12. Compliance with Laws and Audit Right

12.1 Each party will comply with all applicable laws and regulations in the provision of their respective obligations and activities hereunder.

12.2 Once every 12 months during the Term of this Agreement, the Client shall have the right, at its own cost and expense, to perform a reasonable audit of CP’s performance under and in compliance with the terms of this Agreement
(although such audits may be conducted more frequently if required by applicable law, a court order, a regulatory authority with jurisdiction or if a breach is suspected). CP will (a) make (CP or Connfido Group) personnel with knowledge of this
Agreement available to the Client; and (b) provide Client with copies of applicable records and other documentation reasonably requested; all as reasonably necessary to carry out such audit. The CP’s expenses related to this audit shall be borne
by the Client.

13. Data Transfers

13.1 The Client acknowledges and agrees that CP shall transfer Personal Data outside the EEA, more specifically to a Connfido Group member based in India as required pursuant clause

13.2 The parties agree that the standard contractual clauses approved by the EU authorities under EU Data Protection Laws and set out in Annex 2 will apply in respect of that processing, and CP will comply with the obligations
of the ‘data importer’ in the standard contractual clauses and the Client will comply with the obligations of the ‘data exporter’.

13.2 The Client acknowledges and accepts that the provision of the Service under the CP’s Merchant Service Agreement may require the processing of Personal Data by sub-processors in countries outside the EEA.

13.3 When CP transfers any Personal Data to a sub-processor located outside of the EEA (without prejudice to clause 4), CP shall in advance of any such transfer ensure that a legal mechanism to achieve adequacy in respect
of that processing is in place, such as:

• The requirement for CP to execute or procure that the sub-processor execute to the benefit of the Client standard contractual clauses approved by the EU authorities under EU Data Protection Laws and set out in Annex 2;
• The requirement for the sub-processor to be certified under the EU-U.S. Privacy Shield Framework; or
• The existence of any other specifically approved safeguard for data transfers (as recognised under EU Data Protection Laws) and/or a European Commission finding of adequacy.

13.4 The following terms apply to the standard contractual clauses set out in Annex 2:

• The Client may exercise its right of audit under clause 12.2 of the standard contractual clauses as set out in; and
• CP may appoint sub-processors subject to the requirements of clauses 5 and 13.3 of this DPA.