Data Processing Agreement (effective October 1, 2026)

This Data Processing Agreement (“DPA”) is entered into by and between the Customer listed in the Quote and corresponding Enterprise Terms of Service or other executed agreement between the parties to which this DPA is attached (“Customer”) and Inkeep, Inc. (“Provider”) and is effective as of the date of Customer’s signature on such Quote (the “Effective Date”).

For data protection inquiries, Customer can contact Provider’s Privacy Officer at privacy@inkeep.com. Customer’s contact for data protection inquiries shall be as set forth in the Quote.

Each of Customer and Provider may be referred to herein as a "party" and together as the "parties".

1. Introduction

This DPA applies to Provider’s Processing of Personal Data on behalf of Customer under one or more separate agreement(s) executed between Provider and Customer, including, but not limited to, the applicable Quote, Enterprise Terms of Service, or other executed agreement (each an “Agreement”) for Provider’s provision of the Platform and Professional Services (collectively, the “Services”), where such Processing is subject to Applicable Data Protection Laws.

Customer enters into this DPA on behalf of itself and, to the extent required under Applicable Data Protection Laws and Regulations, in the name and on behalf of its Affiliates as applicable. For the purposes of this DPA only, and except where expressly indicated otherwise, the term “Customer” shall include Customer and Affiliates, if applicable.

Provider enters into this DPA on behalf of itself and, to the extent required under Applicable Data Protection Laws and Regulations, in the name and on behalf of its Affiliates that are directly involved in the processing of Customer Data under the Agreement. For the purposes of this DPA only, and except where expressly indicated otherwise, the term “Provider” shall include Provider and its Affiliates, as applicable.

2. Definitions

Capitalized terms that are used but not defined in this DPA have the meanings given in the Agreement.

a. “Affiliate” means any entity that directly or indirectly controls, is controlled by, or is under common control with the subject entity. “Control” for purposes of this definition, means direct or indirect ownership or control of more than 50% of the voting interest of the subject entity.

b. “Applicable Data Protection Laws” means, with respect to a party, all privacy, data protection, breach notification, and information security-related laws and regulations applicable to such party’s Processing of Personal Data.

c. “Customer Data” means Personal Data provided by Customer or collected by Provider from Customer for purposes of obtaining or providing, as applicable, Services under the Agreement.

d. “Data Subject” means the identified or identifiable natural person who is the subject of Personal Data.

e. “Personal Data” means any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as name, identification number, location data, an online identifier or to one or more factors specific to his/her physical, physiological, genetic, mental, economic, cultural or social identity. Personal data may also be referred to as “personal information”, “personally identifiable information”, or similar term governed by Applicable Data Protection Laws.

f. “Process” means any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.

g. “Security Incident” means any unauthorized or unlawful breach of security that leads to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Data Processed by Provider.

h. “Subprocessor” means any third-party authorized by Provider to Process Customer Data.

3. General; Termination

a. This DPA forms part of the Agreement and is expressly incorporated into and made a part of the Agreement. Except as expressly modified by this DPA, the Agreement remains unchanged and in full force and effect. If there is any conflict between this DPA and the Agreement, this DPA will govern solely to the extent of the conflict and will not otherwise amend or supersede the Agreement.

b. The parties acknowledge and agree that Provider’s access to Customer Data does not constitute part of the consideration exchanged by the parties in respect of the Agreement.

c. Any liabilities arising under this DPA are subject to the limitations of liability in the Agreement unless otherwise required by Applicable Data Protection Laws. Provider shall not be liable for any fines, penalties, damages, or other regulatory liabilities imposed by a governmental or supervisory authority to the extent such liabilities result solely from Customer’s acts or omissions, including any failure to comply with its obligations under Applicable Data Protection Laws or this DPA. Nothing in this DPA shall be construed to expand or modify the indemnification obligations set forth in the Agreement. To the extent any indemnification obligations arise in connection with this DPA, such obligations shall apply only to breaches of this DPA caused by the indemnified party’s own acts or omissions, and shall be subject to the limitations and exclusions of liability set forth in the Agreement.

d. This DPA will be governed by and construed in accordance with governing law and jurisdiction provisions in the Agreement, unless required otherwise by Applicable Data Protection Laws.

e. The provisions of this DPA shall survive the termination or expiration of the Agreement as long as Provider continues to Process Customer Data in connection with the Agreement.

4. Relationship of the Parties

a. Provider as Processor. The parties acknowledge and agree that with regard to the Processing of Customer Data, Customer may act as a controller or processor and Provider is a processor. Provider will Process Customer Data in accordance with Customer’s instructions as outlined in Section 6 (Role and Scope of Processing).

5. Compliance with Law. Each party will comply with its obligations under Applicable Data Protection Laws with respect to its Processing of Customer Data.

6. Role and Scope of the Processing

a. Customer Instructions. Customer makes Customer Data available to Provider only for the limited and specified purpose(s) set forth in the Agreement, which may be used by Provider only for such purposes. Provider will Process Customer Data only in accordance with Customer’s instructions. By entering into the Agreement, Customer instructs Provider to Process Customer Data to provide the Services and pursuant to any other written instructions given by Customer and acknowledged in writing by Provider as constituting instructions for purposes of this DPA. Customer acknowledges and agrees that such instruction authorizes Provider to Process Customer Data (a) to perform its obligations and exercise its rights under the Agreement; and (b) to perform its legal obligations and to establish, exercise, or defend legal claims in respect of the Agreement. Customer represents and warrants that all instructions provided to Provider under this DPA will be lawful under Applicable Data Protection Laws, consistent with the intended use and operation of the Services, and will not impose material burdens, technical obstacles, or additional costs on Provider without Provider’s prior written consent. Schedule 1 (Subject Matter & Details of Processing) further specifies the Nature and Purpose of the Processing, the Processing Activities, the Duration of the Processing, the Categories of Data Subjects, the Categories of Personal Data, and Sensitive Data or Special Categories of Data.

b. Provider Processing. Provider will not (a) sell Customer Data; (b) retain, use, or disclose any Customer Data for any purpose other than for the specific purpose of providing the Services, including retaining, using, or disclosing the Customer Data for a commercial purpose other than providing the Services; or (c) retain, use, or disclose the Customer Data outside of the direct business relationship between Provider and Customer. Provider will ensure that its personnel with access to Customer Data are subject to a duty of confidentiality with respect to that data. Provider will notify Customer if Provider makes a determination that it can no longer meet its obligations under Applicable Data Protection Laws.

7. Subprocessing

a. Customer specifically authorizes Provider to (i) use its Affiliates as Subprocessors, and (ii) engage Subprocessors to Process Customer Data. In such instances, Provider:

(i) will enter into a written agreement with each Subprocessor, imposing data protection obligations substantially similar to those set out in this DPA; and

(ii) will, subject to the limitations of liability included in the Agreement, be liable for a Subprocessor’s compliance with Provider’s obligations in this DPA.

b. A list of Provider’s Subprocessors, including their functions and locations, is available at https://inkeep.com/policies/subprocessors (“Subprocessor Page”), and may be updated by Provider from time to time in accordance with this DPA.

c. When any new or replacement Subprocessor is engaged, Provider will notify Customer of the engagement, which notice may be given by updating the Subprocessor Page or by otherwise providing written notice to Customer. Provider will give such notice at least ten (10) calendar days before the new or replacement Subprocessor Processes any Customer Data, except that if Provider reasonably believes engaging a new or replacement Subprocessor on an expedited basis is necessary to protect the confidentiality, integrity, or availability of the Customer Data or avoid material disruption to the Services, Provider will give such notice as soon as reasonably practicable. If, within ten (10) calendar days after such notice, Customer notifies Provider in writing that Customer objects to Provider’s appointment of a new or replacement Subprocessor based on reasonable data protection concerns, the parties will discuss such concerns in good faith and whether they can be resolved. If Provider is reasonably able to provide the Services to the Customer in accordance with an Agreement without using the Subprocessor and decides in its discretion to do so, then the Customer will have no further rights under this Section 7.c in respect of the proposed use of the Subprocessor. If the parties are not able to mutually agree to a resolution of such concerns, Customer, as its sole and exclusive remedy, may terminate the Agreement only in relation to the Services to which the proposed new Subprocessor’s processing of Customer Data relates or would relate for convenience with no refunds, and Customer will remain liable to pay any committed fees in a Quote or other similar ordering document. If the Customer does not provide a timely objection to any new or replacement Subprocessor in accordance with this Section 7.c, Customer will be deemed to have consented to the Subprocessor and waived its right to object. Provider may use a new or replacement Subprocessor while the objection procedure in this Section 7.c is in process.

8. Security

a. Security Measures. Provider will implement and maintain technical and organizational security measures designed to protect Customer Data from Security Incidents and to preserve the security and confidentiality of the Customer Data, in accordance with Provider’s security standards referenced in Schedule 2 (Technical & Organizational Security Measures) (“Security Measures”). Provider’s obligations under this Section apply only to systems and environments under its exclusive control. Provider will not be liable for any Security Incident or other unauthorized access or disclosure resulting from Customer’s failure to properly configure the Services, secure its systems, or use available security features.

b. Customer Responsibility.

(i) Customer is responsible for reviewing the information made available by Provider relating to data security and making an independent determination as to whether the Services meet Customer’s requirements and legal obligations under Applicable Data Protection Laws. Customer acknowledges that the Security Measures may be updated from time to time to reflect process improvements or changing practices (but the modifications will not materially decrease Provider’s obligations as compared to those reflected in such terms as of the Effective Date).

(ii) Customer agrees that, without limitation of Provider’s obligations under this Section 8, Customer is solely responsible for its use of the Services, including (a) making appropriate use of the Services to ensure a level of security appropriate to the risk in respect of the Customer Data; (b) securing the account authentication credentials, systems, and devices Customer uses to access the Services; (c) securing Customer’s systems and devices that interact with the Services; (d) maintaining its own backups of Customer Data; and (e) ensuring appropriate use of any self-service or configurable security features made available by Provider.

c. Security Incident. Upon becoming aware of a confirmed Security Incident, Provider will notify Customer without undue delay unless not permitted by applicable law. A delay in giving such notice requested by law enforcement and/or in light of Provider’s legitimate needs to investigate or remediate the matter before providing notice will not constitute an undue delay. Such notices will describe, to the extent reasonably possible, details of the Security Incident, including steps taken to mitigate the potential risks and steps Provider recommends Customer take to address the Security Incident. Without prejudice to Provider’s obligations under this Section 8.c, Customer is solely responsible for complying with Security Incident notification laws or other obligations applicable to Customer and fulfilling any third-party notification obligations related to any Security Incidents. Provider’s notification of or response to a Security Incident under this Section 8.c will not be construed as an acknowledgement by Provider of any fault or liability.

9. Audits and Reviews of Compliance. The parties acknowledge that Customer must be able to assess Provider’s compliance with its obligations under Applicable Data Protection Law and this DPA, insofar as Provider is acting as a processor on behalf of Customer. Customer has the right, upon reasonable advance notice, to take reasonable and appropriate steps to stop and remediate any unauthorized use of Customer Data by Provider under the Agreement.

a. Provider’s Audit Program. Provider will use external auditors to verify the adequacy of its Security Measures with respect to its processing of Customer Data. Such audits are performed at least once annually at Provider’s expense by independent third-party security professionals at Provider’s selection and result in the generation of a confidential audit report (“Audit Report”). Provider is SOC 2 Type II compliant; contact privacy@inkeep.com for a copy of the report.

b. Customer Audit. Upon Customer’s written request no more than once per year, and subject to reasonable confidentiality controls, Provider will make available to Customer a copy of Provider’s most recent Audit Report. Customer agrees that any audit rights granted by Applicable Data Protection Laws will be satisfied by these Audit Reports. To the extent the Audit Report does not provide reasonably sufficient information for Customer to verify Provider’s compliance with this DPA or Customer is required to respond to a regulatory authority audit, Customer may request a further audit subject to a mutually agreed-upon audit plan with Provider that: (a) ensures the use of an independent third-party; (b) provides reasonable advance written notice to Provider; (c) requests access only during business hours and in a manner that minimizes disruption to Provider’s operations; (d) accepts billing the expense of the audit to Customer at Provider’s then-current rates; (e) occurs no more than once annually, unless required due to a Security Incident or regulatory inquiry; (f) restricts findings to only Customer Data relevant to Customer; and (g) obligates Customer, to the extent permitted by law or regulation, to keep confidential any information gathered that, by its nature, should be confidential.

10. Impact Assessments and Consultations. Provider will provide reasonable cooperation to Customer in connection with any data protection impact assessment (at Customer’s expense) or consultations with regulatory authorities that may be required in accordance with Applicable Data Protection Laws. Provider is entitled to recover all reasonable and actual costs incurred in providing such assistance, unless required by law to provide it without charge.

11. Data Subject Requests. Provider will, upon Customer’s request (and at Customer’s expense), provide Customer with such assistance as it may reasonably require to comply with its obligations under Applicable Data Protection Laws to respond to requests from individuals to exercise their rights under Applicable Data Protection Laws (e.g., rights of data access, rectification, erasure, restriction, portability, and objection) in cases where Customer cannot reasonably fulfill such requests independently by using the self-service functionality of the Services. If Provider receives a request from a Data Subject in relation to their Customer Data, Provider will advise the Data Subject to submit their request to Customer, and Customer will be responsible for responding to any such request.

12. Return or Deletion of Customer Data

a. Provider will, within thirty (30) days following termination of the Agreement, delete all Customer Data from systems under Provider’s active control, except as otherwise instructed by Customer or as required by applicable law.

b. Notwithstanding the foregoing, Customer understands and agrees that Provider may retain Customer Data if required by law or to the extent such data exists within backups or archival media that is not reasonably accessible or searchable in the ordinary course of business. Such data will be deleted in accordance with Provider’s standard retention schedules for such media and will remain subject to the requirements of this DPA. Provider will not be obligated to restore or search such data except as required by applicable law.

13. International Provisions

a. Processing in the United States. Customer acknowledges that, as of the Effective Date, Provider’s primary processing facilities are in the United States.

b. Jurisdiction Specific Terms. To the extent that Provider Processes Customer Data originating from and protected by Applicable Data Protection Laws in one of the Jurisdictions listed in Schedule 4 (Jurisdiction Specific Terms), then the terms specified therein with respect to the applicable jurisdiction(s) will apply in addition to the terms of this DPA.

c. Cross Border Data Transfer Mechanism. To the extent that Customer’s use of the Services requires an onward transfer mechanism to lawfully transfer Personal Data from a jurisdiction (i.e., the European Economic Area (“EEA”), the United Kingdom (“UK”), Switzerland, or any other jurisdiction listed in Schedule 3) to Provider located outside of that jurisdiction (a “Transfer Mechanism”), the terms and conditions of Schedule 3 (Cross Border Transfer Mechanisms) will apply.

[Remainder of Page Intentionally Left Blank]

SCHEDULE 1

SUBJECT MATTER & DETAILS OF PROCESSING

1. Nature and Purpose of the Processing. Provider will process Customer Data as necessary to provide the Services under the Agreement. Provider will process Customer Data as a processor in accordance with Customer’s instructions as outlined in Section 6.a (Customer Instructions) of this DPA and as permitted by law.

2. Processing Activities.

a. Customer Data. Customer Data will be subject to the following basic processing activities: the provision of Services that allow for Customer to consolidate, manage, and control their infrastructure and Customer Data.

3. Duration of the Processing. Prior to the termination of the Agreement, Provider will process stored Customer Data for the purpose of providing the Services until Customer elects to delete such Customer Data via the Provider Services or as set forth in Section 12 (Return or Deletion of Customer Data) of this DPA.

4. Categories of Data Subjects: Customer’s Users.

5. Categories of Customer Data.

a. The categories of Customer Data are such categories as Customer is authorized to ingest into the Services under the Agreement and may include, but is not limited to, one or more of the following:

Name and surname
Gender
Address
Email address
Telephone Number
Language/country
User ID; booking ID; transaction ID
IP address
Geolocation (imprecise)
Marital status; number of children

6. Sensitive Data or Special Categories of Data.

a. Customer Data. Unless otherwise permitted by the Agreement, Customer shall not provide for Processing sensitive data or special categories of data.

SCHEDULE 2

TECHNICAL & ORGANIZATIONAL SECURITY MEASURES

Where applicable, this Schedule 2 will serve as Annex II to the Standard Contractual Clauses. The following provides more information regarding Provider’s technical and organizational security measures set forth below.

Technical and Organizational Security Measures:

1. Measures for ensuring accountability.

Provider has adopted measures for ensuring accountability, such as implementing data protection policies across the business, maintaining documentation of processing activities, recording and reporting Security Incidents involving Personal Data, and appointing a Data Protection Officer.

Additionally, Provider is SOC 2 Type II compliant.

2. Measures for ensuring data minimization.

Provider’s Customers unilaterally determine what Customer Data they route through the Services and how the Services are configured. As such, Provider operates on a shared responsibility model.

3. Measures for ensuring data quality.

Each Customer chooses what Customer Data they route through the Services and how the Services are configured. As such, Provider operates on a shared responsibility model. Provider ensures that data quality is maintained from the time a Customer sends Customer Data into the Services and until that Customer Data leaves Provider to flow to a downstream destination.

4. Measures for ensuring limited data retention.

Provider’s Customers unilaterally determine what Customer Data they route through the Provider Services and how the Services are configured. As such, Provider operates on a shared responsibility model. If a Customer is unable to delete Customer Data via the self-services functionality of the Services, then Provider will delete Customer Data as provided in Section 12 of this DPA and in accordance with Applicable Data Protection Laws.

5. Measures for allowing data portability and ensuring erasure.

Provider's Customers have direct relationships with their Users and are responsible for responding to requests from their Users who wish to exercise their rights under Applicable Data Protection Laws. Provider has built-in self-service functionality to the Services that allow Customers to delete and manage Customer Data. If a Customer is unable to use such self-service functionality, Provider will provide assistance to such Customer as may reasonably be required to comply with Customer's obligations as provided in this DPA and as required under Applicable Data Protection Laws, including to respond to requests from individuals to exercise their rights under Applicable Data Protection Laws (e.g., rights of data access, rectification, erasure, restriction, portability, and objection). If Provider receives a request from a Data Subject in relation to their Customer Data, Provider will advise the Data Subject to submit their request to Customer, and Customer will be responsible for responding to any such request.

6. Technical and organizational measures to be taken by the sub-processor to be able to provide assistance to the controller and, for transfers from a processor to a sub-processor, to the Customer.

When Provider engages a Sub-processor under Section 7 (Subprocessing) of this DPA, Provider and the Sub-processor enter into an agreement as described in this DPA. Each Sub-processor agreement will ensure that Provider is able to meet its obligations under this DPA. In addition to implementing technical and organizational measures to protect Personal Data, Sub-processors will be required to (a) notify Provider in the event of a Security Incident involving Customer Data so that Provider may notify Customer as provided in this DPA; (b) delete Personal Data when instructed by Provider in accordance with Customer’s instructions to Provider; (c) not engage additional Subprocessors without authorization; (d) not change the location where Personal Data is processed; or (e) process Personal Data in a manner which conflicts with Customer’s instructions to Provider.

SCHEDULE 3

CROSS BORDER DATA TRANSFER MECHANISM

1. Definitions

a. “Standard Contractual Clauses” means, depending on the circumstances unique to any particular Customer, any of the following:

(i) IDTA; and

(ii) 2021 Standard Contractual Clauses.

b. “IDTA” means the International Data Transfer Agreement and/or Addendum to the European Commission’s Standard Contractual Clauses issued by the UK Information Commissioner under section 119A(1) Data Protection Act 2018.

c. "2021 Standard Contractual Clauses" means the Standard Contractual Clauses approved by the European Commission in decision 2021/914.

2. UK Data Transfers. For data transfers from the United Kingdom that are subject to the IDTA, the IDTA will be deemed entered into (and incorporated into this DPA by reference) and completed as follows:

Table 1: The Parties: as stipulated in provision 3(d)(vi) below.

Table 2: Selected SCCs, Modules and Selected Clauses: as stipulated in provision 3 below.

Table 3: Appendix Information: means the information which must be provided for the selected modules as set out in the Appendix of the 2021 Standard Contractual Clauses (other than the Parties).

Table 4: Ending this Addendum when the Approved Addendum Changes: Neither Party may end the UK Addendum incorporated herein in the manner set out in Section 19 of the UK Addendum thereto.

3. The 2021 Standard Contractual Clauses. For data transfers from the European Economic Area, the UK, and Switzerland that are subject to the 2021 Standard Contractual Clauses, the 2021 Standard Contractual Clauses will apply in the following manner:

a. Module Two (Controller to Processor) will apply where Customer is a controller of Customer Data and Provider is a processor of Customer Data.

b. Module Three (Processor to Processor) will apply where Customer is a processor of Customer Data and Provider is a sub-processor of Customer Data.

c. For each Module, where applicable:

(i) in Clause 7, the option docking clause will not apply;

(ii) in Clause 9, Option 2 will apply, and the time period for prior notice of sub-processor changes will be as set forth in Section 7 (Subprocessing) of this DPA;

(iii) in Clause 11, the optional language will not apply;

(iv) in Clause 17 (Option 1), the 2021 Standard Contractual Clauses will be governed by Irish law.

(v) in Clause 18(b), disputes will be resolved before the courts of Ireland;

(vi) In Annex I, Part A:

Data Exporter: Customer and authorized Affiliates of Customer.

Contact Details: Customer’s account owner email address, or to the email address(es) for which Customer elects to receive privacy communications.

Data Exporter Role: The Data Exporter’s role is outlined in Section 4 of this DPA.

Signature & Date: By entering into the Agreement, Data Exporter is deemed to have signed these Standard Contractual Clauses incorporated herein, including their Annexes, as of the Effective Date of the Agreement.

Data Importer: Provider and authorized Affiliates of Provider.

Contact Details: Provider Privacy Team – privacy@inkeep.com

Data Importer Role: The Data Importer’s role is outlined in Section 4 of this DPA.

Signature & Date: By entering into the Agreement, Data Importer is deemed to have signed these Standard Contractual Clauses, incorporated herein, including their Annexes, as of the Effective Date of the Agreement.

(vii) In Annex I, Part B:

The categories of data subjects are described in Schedule 1, Section 4.

The sensitive data transferred is described in Schedule 1, Section 6.

The frequency of the transfer is a continuous basis for the duration of the Agreement.

The nature of the processing is described in Schedule 1, Section 1.

The purpose of the processing is described in Schedule 1, Section 1.

The period of the processing is described in Schedule 1, Section 3.

For transfers to sub-processors, the subject matter, and nature of the processing is outlined at https://privacy.inkeep.com/subprocessors. The duration of the processing is the term of the relevant contract.

(viii) In Annex I, Part C: The Irish Data Protection Commission will be the competent supervisory authority.

(ix) Schedule 2 serves as Annex II of the Standard Contractual Clauses.

4. As to the specific module, the parties agree that the following module applies, as the circumstances of the transfer may apply:

Controller-Processor - Module Two, when Provider is acting as a Processor as to Customer Data.

5. To the extent there is any conflict between the Standard Contractual Clauses and any other terms in this DPA, including Schedule 4 (Jurisdiction Specific Terms), the provisions of the Standard Contractual Clauses will prevail.

SCHEDULE 4

JURISDICTION SPECIFIC TERMS

1. EEA

a. The definition of “Applicable Data Protection Laws” includes the General Data Protection Regulation, Regulation (EU) 2016/679 (“GDPR”).

b. When Provider engages a Subprocessor under Section 7 (Subprocessing), it will:

(i) require any appointed Subprocessor to protect Customer Data to the standard required by Applicable Data Protection Laws, such as including the same data protection obligations referred to in Article 28(3) of the GDPR, in particular providing sufficient guarantees to implement appropriate technical and organizational measures in such a manner that the processing will meet the requirements of the GDPR; and

(ii) require any appointed Subprocessor to agree in writing to only process data in a country that the European Union has declared to have an “adequate” level of protection; or to only process data under the terms of Schedule 3.

c. GDPR Penalties. Notwithstanding anything to the contrary in this DPA or in the Agreement (including, without limitation, either party’s indemnification obligations), neither party will be responsible for any GDPR fines issued or levied under Article 83 of the GDPR against the other party by a regulatory authority or governmental body in connection with such other party’s violation of the GDPR.

2. Switzerland

a. The definition of “Applicable Data Protection Laws” includes the Swiss Federal Act on Data Protection.

b. When Provider engages a Subprocessor under Section 7 (Subprocessing), it will

3. United Kingdom

a. References in this DPA to GDPR will to that extent be deemed to be references to the corresponding laws of the United Kingdom (including the UK GDPR and Data Protection Act 2018).

b. When Provider engages a Subprocessor under Section 7 (Subprocessing), it will: