Contract analysis

1. Capitalized terms used but not defined in this DPA shall have the meanings ascribed to them in the Principal Agreement.

2. References in this DPA to specific Articles of the GDPR shall be construed as including corresponding or equivalent provisions of the UK GDPR and any other Applicable Data Protection Law, unless the context requires otherwise.

3. References to any statute, regulation, or legislative instrument shall include any amendment, re-enactment, or successor legislation thereto.

4. The headings in this DPA are for convenience of reference only and shall not affect the interpretation of any provision.

5. Words importing the singular include the plural and vice versa, and words importing any gender include all genders.

6. In the event of any conflict or inconsistency between the provisions of this DPA and the provisions of the Principal Agreement, this DPA shall prevail with respect to all matters relating to data protection, the Processing of Personal Data, and the rights and obligations of the parties as Controller and Processor, respectively. In the event of any conflict between this DPA (excluding the SCCs and UK Addendum) and

2. Additional Data Exporter (under Clause 7 — Docking Clause):

3. Additional Data Exporter (under Clause 7 — Docking Clause): Data Importer. Part B: Description of the Transfer Categories of Data Subjects The Personal Data transferred and Processed under this DPA relates to the following categories of Data Subjects: (a) Employees, contractors, consultants, and other authorized users of Meridian's end-user customers who are granted access to the Lumos Prism™ platform; (b) Meridia

1. Overview. The following technical and organizational measures are implemented by Lumos Analytics Inc. to ensure a level of security appropriate to the risk of the Processing of Personal Data under this DPA. These measures are designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or unauthorized access, taking into account the state of the art, the

2. Measures of Encryption and Pseudonymization (a) Encryption in Transit: All Personal Data transmitted between Data Subjects, end-user customers, and the Lumos Prism™ platform is encrypted using Transport Layer Security (TLS) version 1.2 or higher. Cipher suites are configured to prioritize forward secrecy and strong encryption algorithms, and deprecated or weak cipher suites are disabled. (b) Encryption at Rest: Al

3. Measures for Ensuring Ongoing Confidentiality, Integrity, Availability, and Resilience (a) Access Controls: Logical access controls are implemented on a role-based access control (RBAC) model, ensuring that personnel are granted access only to the Personal Data and systems necessary for the performance of their duties. Multi-factor authentication (MFA) is enforced for all administrative and privileged access. (b)

4. Measures for Ensuring the Ability to Restore Availability and Access to Personal Data in a Timely Manner (a) Backup: Automated daily backups of all Personal Data are performed, with backup data stored at a geographically separate, off-site location within the European Union. Backups are encrypted using AES-256. (b) Disaster Recovery: Lumos maintains a documented disaster recovery plan with a Recovery Time Objectiv

5. Processes for Regularly Testing, Assessing, and Evaluating Effectiveness (a) SOC 2 Type II Audi