DATA PROCESSING AGREEMENT

Effective Date: {{EFFECTIVE_DATE}}

---

This Data Processing Agreement (this "Agreement") is entered into as of {{EFFECTIVE_DATE}}, by and between:

{{COMPANY_NAME}} (the "Company"), acting as Data Controller, and

{{PROCESSOR_NAME}} (the "Data Processor"),

collectively referred to as the "Parties." This Agreement forms part of the services agreement between the Parties (the "Principal Agreement") and governs the processing of personal data by the Data Processor on behalf of the Company in compliance with Regulation (EU) 2016/679 (the "GDPR") and applicable data protection laws.

---

1. Definitions

---

1.1 "Agreement" means this Data Processing Agreement and all schedules attached hereto.

1.2 "Company Personal Data" means any Personal Data processed by the Data Processor on behalf of the Company pursuant to or in connection with the Principal Agreement.

1.3 "Data Protection Laws" means the GDPR and, to the extent applicable, the data protection or privacy laws of any other applicable jurisdiction.

1.4 "GDPR" means the EU General Data Protection Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016.

1.5 "Personal Data," "Data Subject," "Processing," "Controller," "Processor," "Personal Data Breach," and "Supervisory Authority" shall have the meanings ascribed to them in the GDPR.

1.6 "Services" means the services provided by the Data Processor to the Company under the Principal Agreement.

1.7 "Subprocessor" means any third party appointed by or on behalf of the Data Processor to process Personal Data on behalf of the Company in connection with this Agreement.

---

2. Processing of Company Personal Data

---

2.1 The Data Processor shall: (a) process Company Personal Data only in accordance with applicable Data Protection Laws; and (b) not process Company Personal Data other than on the documented instructions of the Company, unless required to do so by applicable law, in which case the Data Processor shall notify the Company of that legal requirement before processing, unless such notification is itself prohibited by law.

2.2 The Company hereby instructs the Data Processor to process Company Personal Data as necessary to perform the Services under the Principal Agreement, as further described in Schedule 1.

---

3. Processor Personnel

---