Contract analysis

ARTICLE 1 — DEFINITIONS For purposes of this DPA, the following terms shall have the meanings set forth below. Capitalized terms used but not defined in this DPA shall have the meanings ascribed to them in the Subscription Agreement. 1.1 "Applicable Data Protection Laws" means all laws, statutes, regulations, ordinances, rules, directives, and binding guidance applicable to the processing of Personal Data under this

ARTICLE 2 — SCOPE AND PURPOSE OF PROCESSING 2.1 Scope. This DPA applies to all processing of Personal Data by Processor on behalf of Controller in connection with the Subscription Agreement. The subject matter, duration, nature and purpose of processing, types of Personal Data, and categories of Data Subjects are described in detail in Schedule A (Description of Processing) attached hereto and incorporated herein by

ARTICLE 3 — CONTROLLER INSTRUCTIONS AND PROCESSOR OBLIGATIONS 3.1 Processing on Instructions. Processor shall process Personal Data only on and in accordance with documented instructions from Controller, including with respect to transfers of Personal Data to a third country or an international organization, unless Processor is required to do so by applicable law of the European Union or the law of a Member State to

ARTICLE 4 — SECURITY MEASURES 4.1 Technical and Organizational Measures. Processor shall implement and maintain, at its own expense, the Technical and Organizational Measures described in Schedule B (Security Measures), which are designed to ensure a level of security appropriate to the risk presented by the processing of Personal Data under this DPA, taking into account the state of the art, the costs of implementat

ARTICLE 5 — SUB-PROCESSING 5.1 General Written Authorization. Controller hereby provides Processor with general written authorization to engage Sub-processors to process Personal Data on behalf of Controller in connection with the Subscription Agreement, subject to compliance with the requirements set forth in this Article 5. This authorization is contingent upon Processor's full compliance with the notice, objection

ARTICLE 6 — DATA SUBJECT RIGHTS 6.1 Cooperation with Data Subject Requests. Processor shall, taking into account the nature of the processing and the information available to Processor, assist Controller by implementing appropriate technical and organizational measures, insofar as this is possible, for the fulfilment of Controller's obligation to respond to requests from Data Subjects exercising their rights under Ap

ARTICLE 7 — PERSONAL DATA BREACH NOTIFICATION 7.1 Notification Obligation. Processor shall notify Controller without undue delay, and in no event later than forty-eight (48) hours, after Processor or any of its Sub-processors becomes aware of a Personal Data Breach affecting Controller's Personal Data. For purposes of this Section, Processor shall be deemed to have become "aware" of a Personal Data Breach at the time

ARTICLE 8 — DATA PROTECTION IMPACT ASSESSMENTS AND PRIOR CONSULTATION 8.1 DPIA Cooperation. Processor shall provide reasonable assistance to Controller in conducting Data Protection Impact Assessments relating to Controller's use of the services provided under the Subscription Agreement, to the extent that Controller does not otherwise have access to the relevant information, and taking into account the nature of the

ARTICLE 9 — INTERNATIONAL DATA TRANSFERS 9.1 Data Locations. Processor shall process Personal Data under this DPA at the following locations, and shall not transfer, access, or process Personal Data at any other location without Controller's prior written authorization: (a) Primary Data Center: Osprey Cloud US-East data center located in Ashburn, Virginia, United States; (b) Secondary / EU Data Center and Processing

ARTICLE 10 — AUDIT RIGHTS 10.1 Right to Audit. Controller, Controller's authorized representative, Controller's external auditors, or any Regulator with jurisdiction over Controller (including the OCC, FDIC, and CFPB) shall have the right to audit, examine, and inspect Processor's compliance with the terms and conditions of this DPA, including Processor's Technical and Organizational Measures, processing activities,