Exiger LLC provides information on our website (the “Site”) subject to the following terms and conditions (the “Terms of Use”). The terms “we,” “our,” “us,” and “Exiger” refer to Exiger LLC. The term “you” refers to each individual user of this site and, if applicable to your use, your employer or firm. By accessing or using the site, you are acknowledging that you have read, understand, and agree, without limitation or qualification to be bound by these Terms of Use and our Privacy Notice. If you disagree with these Terms of Use and our Privacy Notice (as amended from time to time) or are dissatisfied with this Site, your only remedy is to discontinue using this Site.

DO NOT USE THIS WEB SITE IF YOU DO NOT AGREE WITH THESE TERMS. Exiger reserves the right, in its sole discretion, to modify, alter or otherwise update this Agreement, or to change or delete any features of this Web Site, at any time, with or without prior notice to you. Such modifications, alterations, and updates of this Agreement shall be effective immediately upon posting upon the Web Site. You agree to be bound by such modified, altered and updated terms if you access or use this Web Site after Exiger has posted notice of modifications, alterations or updates. IF YOU DO NOT AGREE WITH ANY OF THE MODIFIED, ALTERED OR UPDATED TERMS, THEN YOU SHOULD NOT USE THIS WEB SITE AFTER SUCH MODIFICATIONS, ALTERATIONS OR UPDATES HAVE BEEN POSTED.

This Web Site may permit you to link to other web sites that may or may not be affiliated with this Web Site and/or with Exiger. These other linked web sites, including the web sites of Exiger’s affiliated companies, as well as the web sites of Exiger’s third party service providers, or partners, (collectively the “Third Parties”), may have different terms of use that are not the same as in this Agreement. Your access to and use of such linked web sites through links provided on this Web Site are not governed by this Agreement, but instead are governed by the terms of use and policies of those web sites, and Exiger disclaims any and all responsibility for your access to and use of such linked web sites.

PRIVACY

Personal Information, as defined in Exiger’s Privacy Notice, and other information about you that you may submit or provide to Exiger through this Web Site is subject to Exiger’s Privacy Notice, which can be found at www.exiger.com/privacy-and-legal-center/#privacy-notice and is incorporated into this Agreement. In addition, by using this Web Site you expressly consent to Exiger collecting Personal Information and other information about you, as more fully provided in Exiger’s Privacy Notice.

USE OF THIS WEB SITE AND INTELLECTUAL PROPERTY RIGHTS

Exiger controls and (either itself and/or through its third party hosts) operates this Web Site. All content on this Web Site, including, but not limited to, text, images, illustrations, graphics, logos, digital downloads, data, software, headers, icons, scripts, audio clips, and video clips, is the property of Exiger or its Third Parties, and is protected by copyrights, trademarks, service marks, and/or other intellectual property rights (which are governed by and subject to United States and international copyright laws and treaty provisions, privacy and publicity laws, and communication regulations and statutes). The content is owned and controlled by Exiger, its affiliated or related entities, or the Third Parties that have licensed or otherwise made available their content or the right to market their products and/or services to Exiger.

You may not use any registered or unregistered trademarks, service marks, copyrighted materials or other proprietary information or intellectual property appearing on this Web Site, including, but not limited to, any logos, images or characters, meta tags or similar code, or hidden text or elements containing such information or property, without the express written consent of the owner of the mark or copyright. You may not frame any trademarks, service marks, copyrights, logos, images, text, or other proprietary information or intellectual property of Exiger, or otherwise incorporate into another web site any of the content or other materials on this Web Site, without Exiger’s express prior written consent. You may not deep link to any page or portion of this Web Site without Exiger’s prior written consent.

Violation of trademark and copyright laws (“Infringement”) may result in significant civil liability or criminal penalties under United States and/or international copyright and trademark laws. You recognize that any reproduction or use of content, copyrights, trademarks, service marks, or other intellectual property on this Web Site, except as authorized by this Agreement, is considered intentional Infringement.

USER’S RESPONSIBILITIES

You warrant and represent to Exiger that you will not use this Web Site for any purpose that is unlawful, illegal or prohibited by this Agreement, including, without limitation, the sending, posting, transmitting, displaying, distributing, or knowingly receiving of or searching for any threatening, harassing, libelous, defamatory, obscene, scandalous, inflammatory, sexually oriented, pornographic, or profane material, content or images, or other images, content or messages that might be considered lewd, lascivious, excessively violent or otherwise offensive. If you violate any of these responsibilities, your permission to use this Web Site immediately terminates without the necessity of any notice by us to you. Exiger, at its sole discretion, retains the right to deny access to this Web Site to anyone for any reason, including for violation of this Agreement.

You agree that any information that you provide will be true, accurate, current and complete. If you provide any information that is untrue, inaccurate, not current or incomplete (or Exiger has reasonable grounds to suspect that such information is untrue, inaccurate, not current or incomplete), Exiger has the right to suspend or terminate your access and activity relating to, and to refuse any and all current or future use of, this Web Site.

PROHIBITED ACTIVITIES

You are specifically prohibited from any use of this Web Site, and you agree not to use or permit others to use this Web Site, without limitation, for any of the following:

(a) take any action that imposes an unreasonable or disproportionately large load on, or waste of valuable time for, the Web Site’s infrastructure or resources, including, but not limited to, sending or promoting the distribution of “spam,” “junk mail,” chain letters, or other such unsolicited or unlawful mass e-mailing techniques;

(b) disclose to, or share with, any unauthorized third parties the IDs, assigned confirmation numbers and/or passwords, or use the IDs, assigned confirmation numbers and/or passwords for any unauthorized purpose, or otherwise allow or facilitate others to gain access to Exiger’s information technology systems, environments, networks, files, data or accounts through the use of the IDs, assigned confirmation numbers and/or passwords;

(c) access or attempt to access Exiger’s information technology systems, environments, networks, files, data or accounts to which express authorization has not been obtained (including access to data not intended for You), or log into a server or account that you are not authorized to access;

(d) attempt to decipher, decompile, disassemble, modify, remove or reverse engineer any of the software or HTML code comprising or in any way making up a part of this Web Site;

(e) interfere with, disrupt, disable or damage (or attempt to interfere with, disrupt, disable or damage), in an unauthorized manner, the use or operation of this Web Site or Exiger’s, its affiliated or related entities’ or the Third Party’s systems, equipment or applications, or service to any user, host, or network, including by use of any programs, scripts, commands, viruses, worms, web bugs, harmful code, Trojan horses, other contaminants, or otherwise. This includes “denial of service” attacks, “flooding” of networks, deliberate attempts to overload a service or to burden excessively a service’s resources, attempts to “crash” a host, and/or modifying or rerouting any content or services provided at this Web Site;

(f) attempt to circumvent or subvert system or network security (i.e., authentication) mechanisms, or probe the security of any system, network, or account, associated or used in conjunction with this Web Site;

(g) upload, post, e-mail or otherwise transmit any information, content, or proprietary rights that you do not have a right to transmit under this Agreement, any law or other contractual or fiduciary relationships; and/or

(h) use any robot, spider, intelligent agent, meta-searching, other automatic device, or manual process to search, monitor or copy Exiger’s Web Site pages or the content.

NO WARRANTIES

ALL CONTENT, PRODUCTS AND SERVICES ON THIS WEB SITE, UNLESS OTHERWISE EXPRESSLY STATED IN WRITING BY EXIGER, ARE PROVIDED “AS IS” AND WITHOUT WARRANTIES OF ANY KIND, EITHER EXPRESS OR IMPLIED. OTHER THAN THOSE WARRANTIES WHICH, UNDER THE U.S. LAWS APPLICABLE TO THESE TERMS, ARE IMPLIED BY LAW AND ARE INCAPABLE OF EXCLUSION, RESTRICTION, OR MODIFICATION, EXIGER DISCLAIMS ANY AND ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.

NEITHER EXIGER, ITS AFFILIATED OR RELATED ENTITIES, NOR THE THIRD PARTIES, NOR ANY PERSON INVOLVED IN THE CREATION, PRODUCTION, HOSTING AND/OR DISTRIBUTION OF THIS WEB SITE, WARRANT THAT THE FUNCTIONS, FEATURES OR SERVICES CONTAINED IN THIS WEB SITE WILL BE UNINTERRUPTED OR ERROR-FREE, THAT DEFECTS WILL BE CORRECTED, OR THAT THE SERVER THAT MAKES THE CONTENT AVAILABLE WILL BE FREE OF VIRUSES OR OTHER HARMFUL COMPONENTS. THE CONTENT THAT YOU ACCESS ON THIS WEB SITE IS PROVIDED SOLELY FOR YOUR CONVENIENCE AND INFORMATION. EXIGER DOES NOT WARRANT OR MAKE ANY REPRESENTATIONS REGARDING THE RESULTS THAT MAY BE OBTAINED FROM THE USE OF THIS WEB SITE, OR AS TO THE RELIABILITY, ACCURACY OR CURRENCY OF ANY CONTENT, SERVICE, AND/OR MERCHANDISE PROVIDED OR ACQUIRED PURSUANT TO YOUR USE OF THIS WEB SITE.

YOUR USE OF THIS WEB SITE IS AT YOUR OWN RISK. YOU (AND NOT EXIGER) ASSUME THE ENTIRE COST OF ALL NECESSARY SERVICING (INCLUDING, WITHOUT LIMITATION, YOUR INTERNET CONNECTION) AND REPAIR OR CORRECTION OF YOUR COMPUTER, NETWORK AND/OR SYSTEM.

LIMITATION OF LIABILITY

IN NO EVENT SHALL EXIGER, ITS AFFILIATED OR RELATED ENTITIES OR THIRD PARTIES, NOR ANY OF ITS OR THEIR RESPECTIVE OFFICERS, DIRECTORS, EMPLOYEES OR AGENTS, OR ANY PERSON OR ENTITY INVOLVED IN THE CREATION, PRODUCTION, DISTRIBUTION AND HOSTING OF THIS WEB SITE, BE LIABLE FOR ANY DIRECT, ACTUAL, INDIRECT, CONSEQUENTIAL, INCIDENTAL, SPECIAL, PUNITIVE OR EXEMPLARY DAMAGES, OF ANY KIND, WHETHER ARISING UNDER CONTRACT, WARRANTY, OR TORT (INCLUDING NEGLIGENCE) OR ANY OTHER THEORY OF LIABILITY, REGARDLESS OF WHETHER EXIGER (OR ITS AFFILIATED OR RELATED ENTITIES OR PROVIDERS) KNEW OR SHOULD HAVE KNOWN OF THE POSSIBILITY OF SUCH DAMAGES, INCLUDING, WITHOUT LIMITATION, FROM THE USE OR ATTEMPTED USE OF THIS WEB SITE OR ANY OTHER LINKED SITE.

GOVERNING LAW AND JURISDICTION

By accessing this Web Site, you agree that this Agreement and your use of the Web Site shall be governed in all respect by the laws of the State of New York, without regard to any conflict of laws provisions, and shall not be governed by the United Nations Convention on the International Sale of Goods. You further agree to submit to the exclusive jurisdiction and venue in the state and federal courts located in the State of New York for all disputes, cases and controversies regarding this Web Site, your use of this Web Site, and any matter arising out of or related to this Agreement.

INDEMNIFICATION

Exiger reserves the right to report any wrongdoing, if and when it becomes aware of it, to any applicable government or law enforcement agencies. You agree to indemnify, defend and hold Exiger, its and their officers, directors, employees, affiliated or related entities, Third Parties, agents, licensors, and suppliers, harmless from and against any and all claims, demands, actions, costs, liabilities, losses and damages of any kind (including attorneys’ fees) resulting from your use of this Web Site, your breach of any provision of this Agreement and/or any negligent acts, omissions or intentional wrongdoing by you.

GENERAL PROVISIONS

Exiger’s failure to act with respect to a breach by you or others does not waive Exiger’s right to act with respect to subsequent or similar breaches. If any provision of this Agreement is held to be invalid or unenforceable, such provision will be struck and the remaining provisions enforced. Headings are for reference purposes only. You and Exiger are dealing at arms’ length, creating a commercial relationship. Exiger is not your agent, representative or fiduciary. The provisions and conditions of this Agreement, and each obligation referenced herein, represent the entire Agreement between Exiger (including the Third Parties), its affiliated or related entities, and you, and supersede any prior agreements or understandings not incorporated herein. In the event that any inconsistencies exist between this Agreement and any future published terms of use or understanding, the last published Agreement shall prevail.

EXIGER RESERVES ANY RIGHTS NOT EXPRESSLY GRANTED OR STATED IN THESE TERMS.

This privacy notice describes how we, Exiger Holdings, Inc. and our subsidiaries and affiliates from time to time (“Exiger,” “we,” “us,” “our”), collect, process, maintain, use and share information about individuals (each a “User,” “you,” “your”) who use our website (www.exiger.com) and related features (collectively, the “Site”) or with whom we communicate or interact. Exiger complies with applicable privacy laws globally. Jurisdiction information is available here.

This notice sets out:

1. Information We Collect About You
2. Cookies And Other Technologies
3. How We Use Your Information
4. Our Promotional Updates And Communications
5. Who We Give Your Information To
6. Where We Store Your Information
7. How We Protect Your Information
8. How Long We Keep Your Information
9. Links To Third Party Sites
10. Child Safety
11. Provision Of Professional Services
12. Your Rights
13. Changes To This Notice
14. Contact Us

Please read the following carefully to understand our views and practices regarding your personal data and how we will treat it. The terms “personal data” and “personal information” or “information” are used interchangeably in this notice to refer to information about you. By engaging with our Site, you acknowledge you have read and understood this privacy notice.

1. Information We Collect About You

We will collect and process the following personal data from you:

• Information you give us
  • This is information about you that you give us directly when you interact with us. You give us personal information by filling in forms on our Site or by corresponding with us by phone, e-mail or otherwise. It includes information you provide when you use our Site, subscribe to our service, search for a product, submit a query, and when you report a problem with our Site.
  • The information you give us may include demographic information, such as your name, job title, company name, country, e-mail address and phone number.
  • If you register for an event we organize, you may submit additional information including your interest in certain topics and products.
  • If you respond to an advertised job vacancy or make a general inquiry regarding employment opportunities with us, you may submit various employment details about yourself, including a CV, resumé or other details of your educational and employment history. For further information on recruitment, please review Exiger’s Human Resources & Job Applicant Privacy Notice.
• Information we collect about you from your use of our site. We will automatically collect technical information from you each time you visit our site. This includes:
  • The Internet protocol (IP) address used to connect your computer to the Internet, browser type and version, time zone setting, browser plug-in types and versions, operating system and platform.
  • The full Uniform Resource Locators (URL), clickstream to, through and from our Site (including date and time), products you viewed or searched for, page response times, download errors, length of visits to certain pages, page interaction information methods used to browse away from the page, any phone number used to call our customer service number, and anysocial media handle used to connect with our customer service team.
• Information we receive from other sources. This is information we receive about you:
  • From other websites or apps we operate or other services we provide.
  • From third parties we work closely with (including, for example, business partners, sub-contractors in technical, payment and delivery services, advertising networks, analytics providers, and search information providers).

2. Cookies And Other Technologies

Our Site uses cookies and/or other similar technologies (“Cookies”) to collect and store certain information. Cookies are pieces of information or code that a website transfers to, or accesses from, your computer hard drive or mobile device to store and sometimes track information about you. Cookies enable you to be remembered when using the same computer or device to interact with websites and online services,and can be used to manage a range of features and content as well as store searches and present personalized content.

Our Site uses Cookies to distinguish you from other users of our Site. This helps us to provide you with a better experience when you browse our Site and allows us to improve our Site. 

Some cookies we use last only for the duration of your web session and expire when you close your browser. Others are used to remember you when you return to our Site.

We use these Cookies if they are necessary for the performance of a contract with you, or if doing so is in our legitimate interests (where we have considered that these are not overridden by your rights), and, if required by law, where you have consented to their use.

Most web browsers automatically accept cookies and similar technologies, but if you prefer, you can change your browser settings to disable Cookies. Your help screen or manual will tell you how to do this. If you disable cookies to our Site, however, you may not be able to take full advantage of our Site.  For instance, you may no longer be able to authenticate the application.

3. How We Use Your Information

We use information held about you in the following ways:

• Information you give to us:
• We will use this information to:
• Take steps to enter into a contract with you or carry out our obligations arising from any existing contract with you.
• If you have given your consent to receive marketing material, provide you with information about our products or services that we feel may interest you,
• where required by law or otherwise in our legitimate interests (provided these interests do not override your right to object to such communications).
• Ensure in our legitimate interests that:
  • Content from our Site is presented in the most effective manner for you and for your computer.
  • We provide you with the information, products and services that you request from us.
• Information we collect about you from your use of our site
• Where we have considered these are not overridden by your rights, we will use this information in our legitimate interests:
• To administer our Site and for internal operations, including troubleshooting, data analysis, testing, research, statistical and survey purposes.
• To take reasonable steps to keep our Site safe and secure.
• For measuring or understanding the effectiveness of advertising we serve to you and others, and to deliver relevant advertising to you.
• To improve our Site so that content is presented in the most effective manner for you and for your computer.
• To allow you to participate in interactive features of our service, when you choose to do so.
• Information we receive from other sources
• We may combine this information with information you give to us and information we collect about you in our legitimate interests (where we have considered that these are not overridden by your rights). We will use this information and the combined information for the purposes set out above as determined by the types of information we receive.

4. Our Promotional Updates And Communications

Where permitted in our legitimate interest or with your prior consent where required by law, we will use your personal information for marketing analysis and to provide you with promotional update communications by email and social media platforms about our products and services.

You can object to further marketing at any time by selecting the “unsubscribe” link at the end of all our marketing and promotional update communications to you, or by sending us an email at data.protection@exiger.com.

5. Who We Give Your Information To

We may give your information to any member of our group:

• We may give your information to any of our subsidiaries, our ultimate holding company and its subsidiaries, who support our processing of personal data under this notice. If any of these parties are using your information for direct marketing purposes, we will only transfer the information to them for that purpose with your prior consent.

We may also give your information to selected third parties:

• Organizations who process your personal data on our behalf and in accordance with our instructions and applicable data protection laws. This includes in supporting the services we offer through the Site in particular those providing website and data hosting services, providing fulfilment services, distributing any communications we send, supporting or updating marketing lists, facilitating feedback on our services and providing IT support services from time to time. These organizations (which may include third party suppliers, agents, sub-contractors and/or other companies in our group) may only use your information to the extent necessary to perform their support functions.
• Advertisers and advertising networks that require data to select and serve relevant adverts to you and others. We do not disclose information about identifiable individuals to our advertisers, but we will provide them with aggregated information about our users. We may also use such aggregated information to help advertisers reach the kind of audience they want to target. We may make use of the personal data we have collected from you to enable us to comply with our advertisers’ wishes by displaying their advertisement to the selected target audience, subject to the cookie section of this notice.
• Analytics and search engine providers that assist us in the improvement and optimization of our Site, subject to the cookie section of this notice. This data is aggregated and will not identify you as an individual.
• Business partners who jointly with us provide services to you and with whom we have entered into agreements in relation to the processing of your personal data.
• In the event that we sell or buy any business or assets, in which case we may disclose your personal data to the prospective seller or buyer of such business or assets subject to the terms of this privacy notice.
• If Exiger Holdings, Inc. or substantially all of its assets are acquired by a third party, in which case personal data held by it about its customers may be one of the transferred assets.

We will disclose your personal information to third parties:

• If we are under a duty to disclose or share your personal data in order to comply with any legal obligation, or in order to enforce or apply our terms of supply terms and other agreements with you; or to protect the rights, property, or safety of Exiger LLC, our customers, or others. This includes exchanging information with other companies and organizations for the purposes of fraud protection and credit risk reduction and to prevent cybercrime.

When you visit our Site, we use the following third parties to process your information:

Company	Processing Type	Learn More
Google, Inc.	Analytics, Advertising	“How Google uses data when you use our partners’ sites or apps”, located at www.google.com/policies/privacy/partners/
New Relic	Telemetry, Performance	https://newrelic.com/termsandconditions/services-notices
HubSpot	Customer Relationship Management, Marketing, and Sales	https://legal.hubspot.com/product-privacy-policy
LinkedIn	Advertising	https://www.linkedin.com/legal/privacy-policy
6sense	Behavior Analytics, Advertising, Marketing and Sales	https://6sense.com/privacy-policy/
Cookiebot	Cookie management	https://www.cookiebot.com/en/privacy-policy/
Vimeo	Analytics	https://vimeo.com/privacy/
SoundCloud	Analytics	https://soundcloud.com/pages/privacy

6. Where We Store Your Information

We are headquartered in the United States of America with offices and servers in Canada, among other places. Therefore, we may transfer, process, and/or store your personal information in the United States and Canada. When we transfer personal information to any destination outside the European Union (EU), the European Economic Area (EEA) or the United Kingdom (UK), we will take all steps reasonably necessary to ensure that your personal data is subject to appropriate safeguards, such as relying on a recognized legal adequacy mechanism, and that it is treated securely and in accordance with this privacy notice.

The European Commission has recognized that the United States, Canada and United Kingdom have data privacy laws providing an adequate level of protection. For transfers to countries viewed as inadequate, we have taken appropriate safeguards to require that your personal data will remain protected in accordance with this privacy notice and as required by applicable data protection laws. These include implementing an adequate method of transfer, such as the European Commission’s Standard Contractual Clauses, for transfers of personal data with our third party service providers and partners. Click here to learn more.

In addition, Exiger continues to comply with the EU-US Data Privacy Framework program (EU-US DPF), the UK Extension to the EU-US DPF, and the Swiss-US Data Privacy Framework program (Swiss-US DPF) as set forth by the US Department of Commerce regarding the collection, use, and retention of personal information transferred from the European Union, the United Kingdom, and Switzerland to the United States, as discussed in Exiger’s Data Privacy Framework Policy.

7. How We Protect Your Information

Exiger will use appropriate technical and organizational security measures to try to protect your personal data from loss, misuse, alteration, theft or destruction. Please be aware that the transmission of information via the internet is not completely secure. Although we will take reasonable steps to safeguard your personal data, we cannot guarantee the security of your personal data transmitted to our site. Any transmission of personal data is at your own risk. Once we have received your information, we will use strict procedures and industry standard security features to try to prevent unauthorized access. Please see Annex II of our Personal Data Processing Agreement to learn more.

8. How Long We Keep Your Information

Exiger will retain your personal data for a reasonable period, taking into account legitimate business needs to collect and retain such information. Information will also be retained for a period necessary to comply with applicable local, state, federal, or country specific regulations and requirements.

We may also retain aggregated and de-identified information without time limits for research purposes and to help us develop and improve our services.

9. Links To Third Party Sites

Our Site may, from time to time, contain links to external sites. Once you click on any of those links you will be leaving our Site and will be directed to another website. This Exiger privacy notice will no longer apply. We are not responsible for the privacy notices, policies, content, or security practices of such sites.

10. Child Safety

Protecting the safety of children when they use the Internet is important to Exiger. Our services and this Site are intended for use by adults, primarily in their business or professional capacities. Our services are not directed to children. We do not target or knowingly collect information from children under the age of 18.

11. Provision Of Professional Services

Exiger will also often receive personal information in the course of providing professional services – ordinarily when we provide services to private individuals, employers, businesses with personal customers, and public-sector clients with constituents. Our engagement letter and terms of business govern our relationship with clients, including what we may do with personal data that is provided to us. Exiger provides many different types of services and its role may not always be visible to the individuals who are data subjects. Exiger processes personal information on data subjects according to the instructions of its clients and relies upon its clients to ensure processing is supported by an adequate legal basis and only in accordance with applicable laws.

12. Your Rights

We will honor your rights under applicable data protection laws. You may have the following rights under GDPR or UK GDPR, and may have similar rights under the laws of other countries.

• Right to be informed: You have the right to be informed about the collection and use of your personal data.
• Right of subject access: You have the right to make a written request for details of your personal information and to be provided with a copy of your personal data held by us.
• Right to rectification: You have the right to have inaccurate information about you corrected or removed.
• Right to erasure: You have the right to have certain personal information about you erased. We will comply with your request unless there is an overriding legitimate ground for retaining the information.
• Right to restriction of processing: You have the right to request that we restrict the processing of your personal data (while we verify or investigate your concerns with this information, for example).
• Right to object: You have the right to object to the further processing of your personal data, including the right to object to marketing (as mentioned in “Our promotional updates and communications” section).
• Right to data portability: You have the right to request that your provided personal data be transferred to you or to a third party in machine-readable format.
• Right to withdraw consent: Where the processing of your personal information by us is based on consent, you have the right to withdraw that consent without detriment at any time by contacting us. If you withdraw your consent, this will not affect the lawfulness of our use of your personal information prior to the withdrawal of your consent.
• Automated Decision Making: You have the right not to be subject to a decision based solely on automated processing significantly affecting you or having a legal effect on you.

You can also exercise the rights listed above at any time by contacting our Data Protection Officer:

Clewin McPherson,
Chief Information Security Officer
+1 (212) 455-9400
data.protection@exiger.com

For data subjects located in the EU: if we are not able to satisfactorily resolve your questions, concerns, or complaints, or if you believe that the processing of your personal data infringes on your rights under applicable data protection laws, you have the right, without prejudice to any other administrative or judicial remedies, to lodge a complaint with a supervisory authority, in particular in the member state of your habitual residence, place of work or place of the alleged infringement. Contact information of the supervisory authorities may be found here: https://www.edpb.europa.eu/about-edpb/about-edpb/members_en

For data subjects in the UK, the Information Commissioner is the supervisory authority in the UK and can provide further information about your rights and our obligations in relation to your personal data, as well as deal with any complaints that you have about our processing of your personal data. Contact information for the UK Information Commissioner can be found here: https://ico.org.uk/

13.  Changes To This Notice

Exiger may modify this privacy notice from time to time at our discretion. Any changes we make will be posted on this page.

14. Contact Us

If you have questions, comments, or complaints about our handling or protection of your personal data or this privacy notice, you may send a message by email to data.protection@exiger.com or may contact our Data Protection Officer:

Clewin McPherson,
Chief Information Security Officer
+1 (212) 382-8199
data.protection@exiger.com

Last modified:   November 22, 2024

Jurisdictions

EEA

UK

Canada

Singapore

Australia

United States

California

This statement is published on behalf of Exiger Limited (Company 8613726) pursuant to section 54 of the UK Modern Slavery Act (2015). Exiger Limited is a wholly-owned subsidiary of Exiger Holdings, Inc., a company headquartered in New York.

In conducting our business, Exiger is committed to protecting and maintaining all internationally recognised human rights with respect to our employees, the communities in which we operate, and the communities within which our supply chains operate globally. This statement reflects our approach to both modern slavery and human rights, and details the action Exiger Limited has taken to address the risk and steps in prevention of modern slavery in our operations and supply chain, and how we intend to improve these efforts moving forward.

Who We Are and What We Do

Exiger is revolutionizing the way corporations, government agencies and banks navigate risk and compliance in their third-parties, supply chains and customers through its software and tech-enabled solutions. Exiger’s mission is to make the world a safe and transparent place to succeed. Emboldening its 550 customers across the globe, including 150 in the Fortune 500 and over 50 government agencies, with award-winning AI technology, Exiger leads the way in ESG, cyber, financial crime, third-party and supply chain management. Its work has been recognized by 40+ AI, RegTech and Supply Chain partner awards.  

By the end of the 2022 financial year, Exiger employed approximately 800 people, with offices in the United States, United Kingdom, Australia, Canada, Romania, and Singapore. Alongside our staff, independent contractors and data service suppliers play a key role in our client-facing teams and in providing our diligence and technology services.

Our Approach to Human Rights and Modern Slavery

Exiger is led by CEO and President Brandon Daniels, who also leads the Board of Directors of Exiger Limited, our UK-based affiliate. Exiger’s Board of Directors provides both leadership and a strong tone from the top regarding ethical conduct.

Exiger was founded to conduct the largest ever court-appointed monitorship of a global financial institution. We are committed to conducting business in a responsible manner. Integrity—one of our company’s seven guiding principles—is embedded in Exiger’s culture through our Code of Conduct, which outlines the values and high ethical standards of both personal and corporate conduct expected of everyone who works for or with Exiger.

Exiger is committed to ensuring that no modern slavery or human trafficking takes place within our business. We have a zero-tolerance policy towards forced or bonded labour; we ensure all our terms of employment are voluntary and adhere to local laws with respect to minimum age requirements, wages, overtime, and working hours; and we expect the same from our suppliers, contractors, and third parties. Further, Exiger employees are encouraged to speak up and to raise any concerns of potential or actual ethical conduct breaches.

Our Assessment of the Risk to our Organisation and Supply Chains and Supplier Due Diligence

Exiger has assessed our organisation’s modern slavery risk to be relatively low given the nature of our service offerings. Exiger is a supply chain and third-party risk management technology company. Exiger employs a highly skilled workforce, and according to the Global Slavery Index, operates almost exclusively in countries with a lower prevalence risk of modern slavery.

Moreover, Exiger ensures all permanent staff and independent contractors undergo a criminal background check prior to onboarding. Additionally, Exiger subjects its diligence suppliers to enhanced due diligence through Exiger’s bespoke third party management software, DDIQ and Insight 3PM. This technology uses artificial intelligence to conduct public records research and negative news screening, as well as risk rates our suppliers to enable Exiger to closely monitor higher-risk suppliers. Our highest risk suppliers are subject to daily negative news screening to ensure we can quickly identify and monitor any new risk.

Exiger’s operational procurement consists primarily of office facility services, such as security and cleaning, and of product purchases, such as laptops, office supplies, and marketing materials. To minimize the risk of modern slavery further down these supply chains, Exiger ensures responsible procurement practices, such as avoiding unreasonable expectations and excessive downward pressure on pricing.

Exiger Limited’s London office obtains facilities services from one supplier. This supplier is a signatory to the UN Global Compact, a public declaration of their commitment to business integrity. The supplier has published their own Modern Slavery Statement explaining the steps they have taken to prevent modern slavery and human trafficking from their supply chains. We will continue to review this relationship to ensure such standards are maintained.

Our Progress During the Previous Financial Year

Although Exiger has never identified a human rights breach within our organisation or our supply chains, we are not complacent. During the past few years we have:

• Updated our Code of Conduct to include specific commitments we have made for addressing ethical issues, including modern slavery and labor rights;
• Updated our procurement process to ensure a more robust due diligence process during new supplier onboarding. In the event that we are considering entering into a high-risk relationship with any supplier, such relationship will be vetted by our internal Client Selection and Conflict Management Committee. If accepted, the relationship will be subject to ongoing monitoring to ensure compliance with our high ethical standards;
• Established a Compliance Oversight Group (COG) to provide oversight of Exiger’s vendor management and risk assessment processes concerning modern slavery and labor rights.  The COG is also responsible for providing training to Exiger employees;
• Implemented an anonymous ethics and compliance reporting hotline, available 24 hours a day to all Exiger employees, in all our host country languages, to ensure that any individual wishing to submit an incident report may do so without fear of retribution; and
• Reviewed our vendors for branded merchandise to identify and assess modern slavery.

Our Plans for the Future

We are committed to continually improving our efforts to identify, address, and prevent modern slavery. Moving forward, we commit to:

• Providing updated modern slavery guidance to our operational procurement staff to further increase awareness of the risks within our supply chains. We will encourage greater consideration of ethical performance as a deciding factor in procurement selection; and
• Monitoring the supply chain of Exiger-branded merchandise; this includes reviewing our vendors, identifying product sources, and identifying and addressing potential modern slavery risks further down the chain.

Exiger Limited’s Board of Directors reviewed and approved this statement and as a declaration of its commitment to address and prevent modern slavery within our business and our supply chains,

Brandon Daniels signed this statement on the behalf of the Board of Directors on July 18, 2023.

Director and CEO

This Data Privacy Policy (“Policy”) describes how Exiger Holdings, Inc. and its subsidiaries and affiliates (“Exiger,” “Company,” “we,” or “us”) collect, use, and disclose certain personally identifiable information that we receive in the United States (“US”) from the European Union/European Economic Area (“EU”), the United Kingdom (“UK”), and Switzerland (“Personal Data”). This Policy applies to the following entities: Exiger LLC, Exiger Diligence, Inc., Exiger ION, LLC, Supply Dynamics, Inc., and Convergent Solutions, Inc. This Policy supplements our Privacy Notice located at http://www.exiger.com/privacy, and unless specifically defined in this Policy, the terms in this Policy have the same meaning as the Privacy Notice.

Exiger complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF); collectively the “Data Privacy Framework Program”. Exiger has certified to the U.S. Department of Commerce (“Commerce”) that it adheres to the EU-U.S. DPF with regard to the processing of personal data received from the European Union and to the UK Extension to the EU-U.S. DPF with regard to the processing of personal data received from the United Kingdom (including Gibraltar). Exiger has certified to Commerce that it adheres to the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this Policy and the Data Privacy Framework Program, the Data Privacy Framework Program shall govern. To learn more about the Data Privacy Framework Program or to view our certifications, please visit https://www.dataprivacyframework.gov/.

Further, for transfers to the US and/or countries viewed as inadequate, we have taken additional appropriate safeguards to require that Personal Data will remain protected in accordance with this Policy and as required by applicable data protection law. These include implementing a supplemental adequate method of transfer, such as the European Commission’s Standard Contractual Clauses (“SCCs”), for transfers of Personal Data with our third-party service providers, as listed in our Privacy Notice, and partners, further details of which can be provided upon request.

For purposes of enforcing compliance with the Data Privacy Framework Program, Exiger is subject to the investigatory and enforcement authority of the US Federal Trade Commission (“FTC”). For more information about the Data Privacy Framework Program, see Commerce’s Data Privacy Framework website located at: https://www.dataprivacyframework.gov/. To review Exiger’s certification representations, see Commerce’s Data Privacy Framework self-certification list located at: https://www.dataprivacyframework.gov/list.

Personal Data Collection and Use

Exiger advises financial institutions and multinational corporations concerning regulatory and financial crimes risk and compliance and provides a range of related investigative, due diligence, consulting, risk management and compliance services. When Exiger processes data received from a client or prospective client (“Client Data”), Exiger does so only pursuant to the client’s or prospective client’s instructions and prior authorization.

Client Data may include Personal Data. We may receive the following categories of Personal Data: name, residence and business address, national/tax identification number, email addresses, date of birth, and/or scans of relevant identification cards/documents. We process Personal Data for the following purposes: advising financial institutions and multinational corporations concerning regulatory and financial crimes risk and compliance and providing a range of related investigative, due diligence, consulting, risk management and compliance services. Further, with regard to applicants and employees, we process personal data for employment purposes.

Exiger will only process Personal Data in ways that are compatible with the purpose that Exiger collected it for, or for purposes the individual later authorizes. Before we use your Personal Data for a purpose that is materially different than the purpose we collected it for or that you later authorized, we will provide you with the opportunity to opt out. Exiger maintains reasonable procedures in compliance with applicable data protection laws to ensure that Personal Data is collected and processed for its intended use and is accurate, complete, and current.

If we collect sensitive Personal Data, we will obtain your opt-in consent where the Data Privacy Framework requires, including if we disclose your sensitive Personal Data to third parties, or before we use your sensitive Personal Data for a materially different purpose than the purpose for which it was collected or that you later authorized.

Exiger processes only the Personal Data that its clients or prospective clients have chosen to share with Exiger. Exiger has no direct or contractual relationship with the subject of this Personal Data (the “Data Subject”). As a result, when Client Data includes Personal Data, the client is solely responsible for satisfying all legal obligations owed directly to the Data Subject under applicable data protection laws.

It is the Exiger client’s or prospective client’s responsibility to ensure that any Personal Data it collects may be legally collected in its country of origin. The client or prospective client is also responsible for providing to the Data Subject any notices required by applicable law, for obtaining consent where legally required, and for responding appropriately to the Data Subject’s request to exercise his or her rights under applicable data protection law with respect to Personal Data.

With the exception of third-party agents or service providers, Exiger does not review privacy policies of third parties with which it contracts. Exiger is not responsible for its client’s or prospective client’s privacy policies or practices or for the client’s or prospective client’s compliance with them. Exiger does not review, comment upon, or monitor its client’s or prospective client’s privacy policies or the client’s or prospective client’s compliance with such policies. Exiger also does not review instructions or authorizations to Exiger to determine whether the instructions or authorizations are in compliance with, or conflict with, the terms of a client’s or prospective client’s published privacy policy or of any notice provided to Data Subjects.

Under the data protections law of the EU member states, the UK, and Switzerland, a “Controller” is an organization that determines the purposes for which and the manner in which Personal Data are to be processed. A “Processor” processes Personal Data on behalf of a Controller, and only in accordance with the Controller’s instructions. Exiger acts as a Processor when it advises a client with respect to matters involving Client Data that includes Personal Data. Exiger acts as a Controller for employee and applicant Personal Data. Occasionally, Exiger acts as a Controller with regard to certain contractual agreements. Whether Exiger is acting as a Processor or a Controller, its actions shall be in compliance with this Policy and applicable data protection law.

Data Transfers to Third Parties

Third-Party Agents or Service Providers. We may transfer Personal Data to our third- party agents or service providers who perform functions on our behalf, including contractors who provide due diligence services. We enter into written agreements with those third-party agents and service providers requiring them to provide the same level of protection the Data Privacy Framework requires and limiting their use of the data to the specified services provided on our behalf. We take reasonable and appropriate steps to ensure that third-party agents and service providers process Personal Data in accordance with our Data Privacy Framework obligations and to stop and remediate any unauthorized processing. In cases of onward transfer to third parties of data of individuals in the EU, UK, or Switzerland received pursuant to the EU-U.S. Data Privacy Framework program (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework Program, Exiger ensures appropriate steps are taken and responsibilities fulfilled in accordance with the Data Privacy Framework requirements and applicable data protection laws.

Transfers to Exiger Affiliates. If we transfer your Personal Data to one of our affiliated entities within our corporate group, we will take steps to ensure that your Personal Data is protected with the same level of protection the Data Privacy Framework requires.

Disclosures for National Security or Law Enforcement. Under certain circumstances, we may disclose your Personal Data in response to valid requests by public authorities, including to meet national security or law enforcement requirements.

Security

Exiger maintains reasonable and appropriate security measures, including conformity with the requirements stated in the standard ISO/IEC 27001:2013, to protect Personal Data from loss, misuse, unauthorized access, disclosure, alteration, or destruction in accordance with the Data Privacy Framework.

Access Rights

We will tell you if we maintain personal information relating to you. Upon request, we will provide you with access to the personal information that we hold about you, if any. You may also correct, amend, or delete the personal information we hold about you. An individual who seeks access, or who seeks to correct, amend, or delete inaccurate data, should direct his query to data.protection@exiger.com. If requested to remove data, we will respond within a reasonable timeframe.

In accordance with applicable data protection law, your right to access your Personal Data may be restricted in exceptional circumstances, including, but not limited to, when the burden or expense of providing this access would be disproportionate to the risks to your privacy in the case in question, or when the rights of persons other than you would be violated by the provision of such access. If we determine that your access should be restricted in a particular instance, we will provide you with an explanation of our determination and respond to any applicable inquiries you may have.

Data Retention

Exiger takes reasonable and appropriate measures to comply with the requirements under Data Privacy Framework Program to retain Personal Data in identifiable form only for as long as it serves a purpose of processing. Specifically, Personal Data will be retained in accordance with our business purposes and our obligations to comply with legal requirements and professional standards, unless a longer retention period is otherwise permitted by law and its retention adheres to the Data Privacy Framework Program.

Questions or Complaints

In compliance with the EU-US Data Privacy Framework program Principles, UK extension to the EU-US Data Privacy Framework program Principles, and Swiss-US Data Privacy Framework program Principles, Exiger commits to resolve complaints about your privacy and our collection or use of your personal information. Individuals in European Union member states, the United Kingdom, or Switzerland with inquiries or complaints regarding this privacy policy should first contact

In compliance with the Data Privacy Framework Program, Exiger commits to resolve complaints about your privacy and our collection or use of your personal information transferred to the United States. European Union individuals with DPF inquiries or complaints should first contact Exiger at: data.protection@exiger.com.

Exiger has further committed to refer unresolved privacy complaints under the Data Privacy Framework Program to an independent dispute resolution mechanism, Data Privacy Framework Services, operated by BBB National Programs. If you do not receive timely acknowledgment of your complaint, or if your complaint is not satisfactorily addressed, please visit https://bbbprograms.org/programs/all-programs/dpf-consumers for more information and to file a complaint. This service is provided free of charge to you.

Binding Arbitration

If your Data Privacy Framework Program complaint cannot be resolved through the above channels, under certain conditions, you may be entitled to invoke binding arbitration for some residual claims not resolved by other redress mechanisms. See https://www.dataprivacyframework.gov/framework-article/G%E2%80%93Arbitration- Procedures.

Contact Us

If you have any questions about this Policy or would like to request access to your Personal Data, please contact us as follows: privacy@exiger.com.

Changes to This Policy

We reserve the right to amend this Policy from time to time consistent with applicable data protection laws and the Data Privacy Framework’s requirements.

Last modified:   November 22, 2024

Exiger is a global firm with offices in Australia, Canada, Romania, Singapore, the United Kingdom, and the United States. The corporate headquarters for Exiger is located in the United States, and this is the central repository for processing information about our employees, contractors, and job applicants.

This Human Resources & Job Applicant Data Privacy Framework Policy (“Policy”) describes how Exiger LLC and its subsidiaries and affiliates in the United States (“US”) (“Exiger,” “Company,” “we,” or “us”) collect, use, and disclose certain personally identifiable information that we receive in the US from our affiliates, including data from the European Union (“EU”), the United Kingdom (“UK”), and Switzerland (“Human Resources Data”). This Policy applies to the following US affiliated entities: Exiger LLC, Exiger Diligence, Inc., Convergent Solutions, Inc., Supply Dynamics, Inc. and Exiger ION LLC. This Policy supplements our Privacy Notice located at http://www.exiger.com/privacy, and unless specifically defined in this Policy, the terms in this Policy have the same meaning as the Privacy Notice.  This Policy is available to Exiger employees as part of Exiger’s employee handbook and as part of job postings. 

Exiger complies with the EU-U.S. Data Privacy Framework program (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework program (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce.  Exiger has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework program Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU-U.S. DPF.  Exiger has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework program Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF.  If there is any conflict between the terms in this privacy policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern.  To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit https://www.dataprivacyframework.gov/.

In addition, for transfers to the US and/or countries viewed as inadequate, we have taken appropriate safeguards to require that your Personal Data will remain protected in accordance with this Human Resources & Job Applicant Data Privacy Framework Policy and as required by applicable data protection law. These include implementing an adequate method of transfer, such as the European Commission’s Standard Contractual Clauses, for transfers of Personal Data with our third-party service providers and partners, further details of which can be provided upon request.

For purposes of enforcing compliance with the Data Privacy Framework, Exiger is subject to the investigatory and enforcement authority of the US Federal Trade Commission. For more information about the Data Privacy Framework, see the US Department of Commerce’s Data Privacy Framework website located at: https://www.dataprivacyframework.gov. To review Exiger’s representation on the Data Privacy Framework list, see the US Department of Commerce’s Data Privacy Framework self-certification list located at: https://www.dataprivacyframework.gov/s/participant-search.

Human Resources Data Collection and Use

We may receive the following categories of Human Resources Data in the US:  name, email, address, telephone number, date of birth, national identification number, gender, nationality. We process Human Resources Data of our employees, contractors, and job candidates for the following purposes: recruiting, onboarding background checks, making benefits available to them, and otherwise enabling them to do their jobs.

Exiger will only process Human Resources Data in ways that are compatible with the purpose that Exiger collected it for, or for purposes the individual later authorizes. Before we use your Human Resources Data for a purpose that is materially different than the purpose we collected it for or that you later authorized, we will provide you with the opportunity to opt out. Exiger maintains reasonable procedures to help ensure that Human Resources Data is reliable for its intended use, accurate, complete, and current.

If we collect sensitive Human Resources Data, we will obtain your opt-in consent where the Data Privacy Framework requires, including if we disclose your sensitive Human Resources Data to third parties, or before we use your sensitive Human Resources Data for a different purpose than we collected it for or than you later authorized. We do not seek to obtain and will not collect such data about a job candidate unless permitted to do so by applicable laws (e.g., US equal opportunity monitoring).

Under the data protection laws of the EU member states, the UK, and Switzerland, a “Controller” is an organization that determines the purposes for which and the manner in which Human Resources Data are to be processed. A “Processor” processes Human Resources Data on behalf of a Controller, and only in accordance with the Controller’s instructions. Exiger acts as a Processor when it advises a client with respect to matters involving Client Data that includes Human Resources Data, and as acts as a Controller when processing Human Resources Data for its employees, contractors, and/or job candidates.

Your personal data may be accessed by Exiger employees or agents (e.g., Human Resources, Employees via an internal address book, recruiters, and/or interviewers working in the country where the position for which you are working or are applying is based, as well as by Exiger Employees or agents working in different countries within the Exiger global organization. Individuals performing administrative functions and IT personnel within Exiger may also have a limited access to your personal data to perform their jobs. In some countries, you may have fewer rights under local law than you do in your country of residence, but we have put in place legal mechanisms designed to ensure adequate protection of your personal data that is processed by Exiger subsidiaries and affiliates within the Exiger global organization, including the transfer of your personal data to countries other than the one in which you reside.

For job candidates, we may also collect work and educational history, achievements, and test results. We also may collect personal data about you from third parties, such as professional recruiting firms, your references, prior employers, Exiger employees with whom you have interviewed, and employment background check providers, to the extent this is permitted by applicable law. We may use your personal data for legitimate human resources and business management reasons including:

• identifying and evaluating candidates for potential employment, as well as for future roles that may become available;
• recordkeeping in relation to recruiting and hiring;
• ensuring compliance with legal requirements, including diversity and inclusion requirements and practices;
• conducting criminal history checks as permitted by applicable law;
• protecting our legal rights to the extent authorized or permitted by law; or
• emergency situations where the health or safety of one or more individuals may be endangered.

We may also analyze your personal data or aggregated/pseudonymized data to improve our recruitment and hiring process and augment our ability to attract successful candidates.

If you elect to join a recruiting program, we may retain your personal data to consider you for future employment opportunities and for a period of time specific to that program, unless you decide to opt-out prior to such time.

You are not required to provide any requested information to us, but failing to do so may result in not being able to continue your candidacy for the job for which you have applied.

We do not make recruiting or hiring decisions based solely on automated decision-making.

Data Transfers to Third Parties

Third-Party Agents or Service Providers. We may transfer Human Resources Data to our third-party agents or service providers who perform functions on our behalf, including payroll processors, insurance brokers and providers of other employee benefits, as well as contractors who provide due diligence services for onboarding.

We enter into written agreements with those third-party agents and service providers requiring them to provide the same level of protection the law requires and limiting their use of the data to the specified services provided on our behalf. We take reasonable and appropriate steps to ensure that third-party agents and service providers process Human Resources Data in accordance with our legal obligations and to stop and remediate any unauthorized processing. In cases of onward transfer to third parties of data of individuals in the EU, UK, or Switzerland received pursuant to the European Commission’s Standard Contractual Clauses, Exiger is potentially liable.

We use third party service providers to provide a recruiting software system. We also may share job applicant’s personal data with other third-party service providers that may assist us in recruiting talent, administering and evaluating pre-employment screening and testing, and improving our recruiting practices.

Some of our online recruiting activities are hosted by third parties. When you access sites operated by these third parties, they may, consistent with our Privacy Policy, place Cookies or Other Tracking Technologies on your device. You can learn more about our use of Cookies and other tracking technologies reading our Privacy Policy.

In addition, we may disclose or transfer your personal data in the event of a re-organization, merger, sale, joint venture, assignment, or other transfer or disposition of all or any portion of our business.

Transfers to Exiger Affiliates.  If we transfer your Human Resources Data to one of our affiliated entities within our corporate group, we will take steps to ensure that your Human Resources Data is protected with the same level of protection the law requires.

Disclosures for National Security or Law Enforcement. Under certain circumstances, we may be required to disclose your Human Resources Data in response to valid requests by public authorities, including to meet national security or law enforcement requirements.

Security

Exiger maintains reasonable and appropriate security measures to protect Human Resources Data from loss, misuse, unauthorized access, disclosure, alteration, or destruction in accordance with the law.

Access Rights

You have the right to obtain our confirmation of whether we maintain personal information relating to you. Upon request, we will provide you with access to the personal information that we hold about you. You may also correct, amend, or delete the personal information we hold about you. An individual who seeks access, or who seeks to correct, amend, or delete inaccurate data, should direct his query to privacy@exiger.com. If requested to remove data, we will respond within a reasonable timeframe.

Your right to access your Personal Data may be restricted in exceptional circumstances, including, but not limited to, when the burden or expense of providing this access would be disproportionate to the risks to your privacy in the case in question, or when the rights of persons other than you would be violated by the provision of such access. If we determine that your access should be restricted in a particular instance, we will provide you with an explanation of our determination and respond to any inquiries you may have.

Data Retention

We retain Human Resources Data according to Exiger’s internal data retention policy. For most of your data, that will be 7 years after your employment has ended (exceptions include, but are not limited to, pension documents, etc.). If you would like the specifics of the retention policy, please contact us at privacy@exiger.com.

If you accept an offer of employment by us, any relevant personal data collected during your pre-employment period will become part of your personnel records and will be retained in accordance with specific country requirements. If we do not employ you, we may nevertheless continue to retain and use your personal data for a period of time (which may vary depending on the country) for system administration purposes, to consider you for potential future roles, and to perform research. Thereafter, we retain a minimum amount of your personal data to record your recruiting activity with us.

Questions or Complaints

In compliance with the EU-US Data Privacy Framework program Principles, UK extension to the EU-US Data Privacy Framework program Principles, and Swiss-US Data Privacy Framework program Principles, Exiger commits to resolve complaints about your privacy and our collection or use of your personal information. Individuals in European Union member states, the United Kingdom, or Switzerland with inquiries or complaints regarding this privacy policy should first contact

In compliance with the EU-US Data Privacy Framework program’s Principles, Exiger commits to resolve complaints about your privacy and our collection or use of your personal information transferred to the United States pursuant to the DPF Principles.  European Union individuals with DPF inquiries or complaints should first contact Exiger at:  privacy@exiger.com.

Exiger has further committed to refer unresolved privacy complaints under the DPF Principles to an independent dispute resolution mechanism, Data Privacy Framework Services, operated by BBB National Programs. If you do not receive timely acknowledgment of your complaint, or if your complaint is not satisfactorily addressed, please visit https://bbbprograms.org/programs/all-programs/dpf-consumers/ProcessForConsumers  for more information and to file a complaint. This service is provided free of charge to you.

Binding Arbitration

If your  DPF complaint cannot be resolved through the above channels, under certain conditions, you may invoke binding arbitration for some residual claims not resolved by other redress mechanisms.  See https://www.dataprivacyframework.gov/s/article/G-Arbitration-Procedures-dpf?tabset-35584=2

Contact Us

If you have any questions about this Policy or would like to request access to your Human Resources Data, please contact us as follows: privacy@exiger.com

Changes to This Policy

We reserve the right to amend this Policy from time to time consistent with the Data Privacy Framework’s requirements.

Last modified:   March 29, 2024

---

Table of Contents

• Personal Data Protection Agreement
  
  • 1. Definitions
  • 2. General Provisions
  • 3. Exiger Responsibilities
  • 4. Customer Responsibilities
  • 5. Country or Regional Specific Terms
  • 6. Miscellaneous

• Appendix A: Description of the Transfer
  
• Appendix B: Standard Contractual Clauses for the transfer of personal data
  
• ANNEXES

---

This Personal Data Processing Agreement (“DPA”), including the applicable Appendices, is entered into by the customer as named in the executed service agreement (“Customer”) and the Exiger entity as named in the executed service agreement, on behalf of itself and its affiliates (“Exiger”), (each a “Party” and, together, the “Parties”) and is attached to and made a part of that executed service agreement between Customer and Exiger (the “Service Agreement”).  The DPA, including the applicable Appendices, is effective as to each Party on the effective date of the Service Agreement.

1. Definitions

All capitalized terms not defined herein shall have the meaning set forth in the Service Agreement.

“Data Subject” means the subject of Personal Data.

“Data Subject Request” means a request by a Data Subject to exercise rights granted under the applicable data protection law.

“Personal Data” means any information received by Exiger from, or created or received by Exiger on behalf of, Customer, relating to an identified or identifiable natural person. An “identifiable natural person” is one who can be identified, directly or indirectly, in particular, by reference to an identification number, location data, an online identifier or to one or more factors specific to the physical, psychological, genetic, mental, economic, cultural or social identity of the natural person.

“Process”, “Processes” or “Processing” means any operation or set of operations which is performed upon Personal Data, whether or not by automatic means, including the collection, recording, organization, storage, updating, modification, retrieval, consultation, use, transfer, dissemination by means of transmission, distribution or otherwise making available, merging, linking as well as blocking, erasure or destruction.

“Supervisory Authority” refers to the relevant government entity that is tasked with governing the Processing of Personal Data.

“Transfer” means physical or electronic movement of Personal Data from one country to another.  Data transfer includes remote access to Personal Data by a user in the destination country.

2. General Provisions

2.1 This DPA applies exclusively to Personal Data Processed by Exiger on behalf of Customer to fulfill Exiger’s obligations to provide services in compliance with the Service Agreement.

2.2 The Parties agree that, with respect to the Personal Data and between the Parties, Customer is the data controller, and Exiger is the data processor, under applicable data protection law.

2.3 Exiger shall Process Personal Data only in accordance with (i) Customer’s reasonable and lawful instructions, or (ii) as required by applicable law.  The Parties agree that Customer’s instructions are reflected in the underlying Service Agreement between the Parties and Appendix A, which describes the nature and purpose of the Processing, the type of Personal Data, and the categories of Data Subjects.

3. Exiger Responsibilities

3.1 Data Security. Exiger shall maintain a privacy and security program that includes reasonable and appropriate measures — including technical, physical, and organizational safeguards taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of Processing, as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons — to protect against reasonably foreseeable risks to the security, confidentiality, integrity and resilience of Personal Data, which risks could result in the unauthorized disclosure, access, use, alteration, loss, destruction or other compromise of the Personal Data, including a Personal Data breach, as breach is defined under applicable data protection law.

3.2 Data Subject Requests: Exiger shall provide reasonable assistance to facilitate the Data Subject Request, provided that Customer shall pay Exiger’s charges for providing such assistance, at Exiger’s standard consultancy rates, and that Customer provides written instructions to Exiger within fifteen (15) business days of receiving the request. Upon receipt of Customer’s written instructions, Exiger will take such action reasonably requested by Customer to assist Customer in responding to a Data Subject Request. In the event a Data Subject submits a Data Subject Request directly to Exiger, Exiger will notify Customer of the Data Subject Request and will await instructions from Customer regarding its response to the Data Subject Request. 

3.3 Sub-Processors: Exiger will obtain reasonable assurances, in writing, from any sub-processor that Processes Personal Data on Exiger’s behalf that the sub-processor will comply with the restrictions and conditions on Processing Personal Data substantially no less protective than the restrictions and conditions that this DPA imposes on Exiger.

3.4 Return Or Destruction Of Personal Data: Within sixty (60) business days of the termination of the Service Agreement, Exiger will return, destroy, or transfer to a third party designated by an authorized Customer representative in writing, all Personal Data.   Other than as set forth in Section 3.5, if Customer directs Exiger to destroy the Personal Data, Exiger will do so in a manner reasonably intended to ensure that recovery of the Personal Data would be impracticable.

3.5 Exiger’s Retention Of Personal Data. If, within fifteen (15) business days of the termination of the Service Agreement, Exiger delivers to Customer written notice explaining the conditions which make return, destruction or transfer of Personal Data as required by paragraph 3.4, above, infeasible, or local law permits or requires Exiger to retain the Personal Data, then Exiger will be excused from complying with paragraph 3.4, above, with respect to the retained Personal Data.  Unless otherwise obligated by law, Exiger will extend the protections of this DPA to the retained Personal Data and limit further Processing of the retained Personal Data to those purposes which make return or destruction infeasible, for as long as Exiger maintains the retained Personal Data.

4. Customer Responsibilities

4.1 Compliance. Customer shall ensure its instructions to Exiger comply with applicable law. Exiger is not responsible for determining for Customer if Customer’s instructions are legally compliant.

4.2 Steps Prior to Transfer. Customer warrants and represents that it has taken all steps legally required under applicable law, including but not limited to, providing notice and obtaining all necessary authorizations required, prior to disclosing, transferring, or otherwise making available, any Personal Data to Exiger under the Service Agreement.

4.3 Accuracy. Customer warrants and represents that it has made reasonable efforts to ensure that any Personal Data that it discloses, transfers, or otherwise makes available to Exiger under the Service Agreement is accurate and complete.

5. Country or Regional Specific Terms

5.1 Certain jurisdictions require the Parties to include additional contractual terms.  Such jurisdiction-specific terms are contained in the following appendices and are incorporated by reference herein.  Appendix A contains a general description of the transfer and is incorporated by reference in certain jurisdiction-specific appendices. The appendices are binding on the Parties as follows: 

(a) Appendix B (EU/EEA & Switzerland): applies when (1) Customer is located in the European Economic Area (“EEA”) or Switzerland, or (ii) contracting on behalf of an affiliated company(ies) located in the EEA or Switzerland, and (2) the Exiger entities providing the services are located in a country that the European Union (“EU”) Supervisory Authority, or Swiss Supervisory Authority, has not deemed to provide adequate data protection.

(b) Appendix C (UK): applies when (1) Customer is (i) located in the United Kingdom (“UK”) or is (ii) contracting on behalf of an affiliated company(ies) located in the UK and (2) the Exiger entity(ies) that will be providing services is located outside of the EEA, UK, or Switzerland.

(c) Appendix D (Intra-Europe): applies when (1) Customer (i) is located in the EEA, UK, or Switzerland, or (ii) is contracting on behalf of an affiliated company(ies) located in the EEA, UK, or Switzerland, and (iii) has contracted with an Exiger entity located in the EEA, UK, or Switzerland, and (2) the Personal Data will not be transferred outside of the EEA, Switzerland or the UK.

(d) Appendix E (California, USA): applies when Customer and the Personal Data is subject to the California Privacy Rights Act (“CPRA”).

(e) Appendix F (Australia & Singapore): applies when (1) Customer is (i) located in Australia or Singapore, or (ii) contracting on behalf of affiliated companies located in Australia or Singapore, and (2) the Exiger entities providing the services are not located in (i) Australia, if Customer or such affiliated company is located in Australia, or (ii) Singapore, if Customer or such affiliated company is located in Singapore.

5.2 In the event of any conflict between the terms of this DPA and the terms of an Appendix regarding Personal Data subject to that Appendix, the terms of the Appendix shall prevail.

6. Miscellaneous

6.1 Survival. Exiger’s obligations and duties under this DPA with respect to Personal Data Processed on Customer’s behalf will survive the termination of the Service Agreement and of this DPA and will continue for as long as the Personal Data remains in Exiger’s possession.

6.2 Entire Agreement. This DPA contains the entire understanding of the Parties with respect to the subject matter of this DPA.

6.3 Conflicting Terms. This DPA is without prejudice to the rights and obligations of the parties under the Service Agreement which shall continue to have full force and effect. In the event of any conflict between the terms of this DPA and the terms of the Service Agreement, the terms of this DPA shall prevail to the extent that the term at issue concerns the Processing of Personal Data.

6.4 Data Breach Notifications. If Customer determines that a data breach with respect to its Personal Data requires notification to any Supervisory Authority, Data Subjects, and/or the public or portions of the public, Customer will provide a minimum of forty-eight (48) hours written notice to Exiger before delivering the Supervisory Authority notification and supply Exiger with copies of the proposed notification that references Exiger, its security measures, and/or role in the data breach, whether or not by name. Subject to Customer’s compliance with applicable data protection law, Customer will consult with Exiger in good faith and take account of any clarifications or corrections Exiger reasonably requests to such notifications.

6.5 Liability. To the extent allowed by law and subject to specific terms in applicable Appendices, Exiger’s liability to Customer, and to each member of Customer Group (taken together), under or in connection with this DPA, including under the Appendices to this DPA, shall be subject to the same limitations and exclusions of liability as apply under the Service Agreement as if that liability arose under the Service Agreement.

6.6 Third-Party Rights. No third party shall be considered a third-party beneficiary under this DPA, nor shall any third party have any rights as a result of this DPA, except as otherwise provided in the applicable appendix.

6.7 Severability. Should any provision of this DPA be determined invalid or unenforceable, then the remainder of this DPA shall remain valid and in force. The invalid or unenforceable provision shall be either (i) amended as necessary to ensure its validity and enforceability, while preserving the parties’ intentions as closely as possible or, if this is not possible, (ii) construed in a manner as if the invalid or unenforceable part had never been contained therein.

6.8 Governing Law and Forum:

(a) Subject to the terms in any applicable Appendices, this DPA shall be governed by and construed in accordance with the laws of the country or territory stipulated for this purpose in the Service Agreement and each of the parties agrees to submit to the Choice of jurisdiction as stipulated in the Service Agreement in respect of any claim or matter arising under this DPA.

(b) Where a specific Appendix identifies a different governing law and forum, such designations will only apply to disputes that arise from the applicable Appendix.

6.9 Termination. Other than with respect to any accrued liabilities of either party and Sections 3.5 and 6.1, this DPA shall terminate automatically on the expiry or termination for whatever reason of the Service Agreement.

Appendix A to the Service Agreement

DESCRIPTION OF THE TRANSFER

Data subjects
The personal data transferred concern the following categories of data subjects:

The data subjects are the data targets of the data exporter. The data subjects may be existing or prospective clients and/or vendors of the data exporter, and individuals who are employees, principals, agents, or representatives of, or otherwise affiliated or associated with, individual or institutional clients and/or vendors, or prospective clients and/or vendors, of the data exporter.

Categories of data
The personal data transferred concern the following categories of data:

Name, address, date of birth, company employment, professional experience and affiliations, wealth data, Social Security Number, Tax ID number, passport number, or other government-issued identification number or code, and such other data that may be transferred from the data exporter to the data importer for the purposes of performing the services pursuant to the Service Agreement.

Special categories of data
The personal data transferred concern the following special categories of data:

Where permitted by law, data importer will process legally reportable criminal convictions and other legally reportable criminal offences; and to the extent revealed in publicly available social media and other processing operations, the sexual orientation, racial or ethnic origin, philosophical beliefs, religious beliefs, political opinions, trade union membership, and sex life of the data subject.

Processing operations (Nature and Purpose)
The personal data transferred will be subject to the following basic processing activities:

Nature: The nature of the data processing activities includes processing activities (e.g., the collection, access, viewing, organizing, disclosing and storing of personal data) as is reasonably required to facilitate and/or support the provision of services as described under the Service Agreement.

Purpose: The purpose of the data processing activities is to provide to data exporter(s) due diligence and/or vetting reports for regulatory purposes and any other services identified in the Service Agreement.

Certain jurisdiction-specific Appendices to this Personal Data Processing Agreement contain additional details about the transfer of the personal data as required by those jurisdictions.
 

Appendix B to the Service Agreement

Standard Contractual Clauses for the transfer of personal data from the European Economic Area to third countries (updated as of 4 June 2021)

Controller to Processor Transfers

SECTION I

Clause 1
Purpose and scope
(a) The purpose of these standard contractual clauses is to ensure compliance with the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) for the transfer of personal data to a third country.

(b) The Parties:
(i) the natural or legal person(s), public authority/ies, agency/ies or other body/ies (hereinafter “entity/ies”) transferring the personal data, as listed in Annex I.A. (hereinafter each “data exporter”), and

(ii) the entity/ies in a third country receiving the personal data from the data exporter, directly or indirectly via another entity also Party to these Clauses, as listed in Annex I.A. (hereinafter each “data importer”) have agreed to these standard contractual clauses (hereinafter: “Clauses”).

(c) These Clauses apply with respect to the transfer of personal data as specified in Annex I.B.

(d) The Appendix to these Clauses containing the Annexes referred to therein forms an integral part of these Clauses.

Clause 2
Effect and invariability of the Clauses
(a) These Clauses set out appropriate safeguards, including enforceable data subject rights and effective legal remedies, pursuant to Article 46(1) and Article 46 (2)(c) of Regulation (EU) 2016/679 and, with respect to data transfers from controllers to processors and/or processors to processors, standard contractual clauses pursuant to Article 28(7) of Regulation (EU) 2016/679, provided they are not modified, except to select the appropriate Module(s) or to add or update information in the Appendix. This does not prevent the Parties from including the standard contractual clauses laid down in these Clauses in a wider contract and/or to add other clauses or additional safeguards, provided that they do not contradict, directly or indirectly, these Clauses or prejudice the fundamental rights or freedoms of data subjects.

(b) These Clauses are without prejudice to obligations to which the data exporter is subject by virtue of Regulation (EU) 2016/679.

Clause 3
Third-party beneficiaries
(a) Data subjects may invoke and enforce these Clauses, as third-party beneficiaries, against the data exporter and/or data importer, with the following exceptions:
(i) Clause 1, Clause 2, Clause 3, Clause 6, Clause 7;
(ii) Clause 8.1(b), 8.9(a), (c), (d) and (e);
(iii) Clause 9(a), (c), (d) and (e);
(iv) Clause 12(a), (d) and (f);
(v) Clause 13;
(vi) Clause 15.1(c), (d) and (e);
(vii) Clause 16(e);
(viii) Clause 18(a) and (b).

(b) Paragraph (a) is without prejudice to rights of data subjects under Regulation (EU) 2016/679.

Clause 4
Interpretation
(a) Where these Clauses use terms that are defined in Regulation (EU) 2016/679, those terms shall have the same meaning as in that Regulation.

(b) These Clauses shall be read and interpreted in the light of the provisions of Regulation (EU) 2016/679.

(c) These Clauses shall not be interpreted in a way that conflicts with rights and obligations provided for in Regulation (EU) 2016/679.

Clause 5
Hierarchy
In the event of a contradiction between theses Clauses and the provisions of related agreements between the Parties, existing at the time these Clauses are agreed or entered into thereafter, these Clauses shall prevail.

Clause 6
Description of the transfer(s)
The details of the transfer(s), and in particular the categories of personal data that are transferred and the purpose(s) for which they are transferred, are specified in Annex I.B.

Clause 7
Docking clause

(a) An entity that is not a Party to these Clauses may, with the agreement of the Parties, accede to these Clauses at any time, either as a data exporter or as a data importer, by completing the Appendix and signing Annex I.A.

(b) Once it has completed the Appendix and signed Annex I.A, the acceding entity shall become a Party to these Clauses and have the rights and obligations of a data exporter or data importer in accordance with its designation in Annex I.A.

(c) The acceding entity shall have no rights or obligations arising under these Clauses from the period prior to becoming a Party.

SECTION II – OBLIGATIONS OF THE PARTIES
Clause 8
Data protection safeguards
The data exporter warrants that it has used reasonable efforts to determine that the data importer is able, through the implementation of appropriate technical and organisational measures, to satisfy its obligations under these Clauses.

8.1 Instructions
(a) The data importer shall process the personal data only on documented instructions from the data exporter. The data exporter may give such instructions throughout the duration of the contract. 

(b) The data importer shall immediately inform the data exporter if it is unable to follow those instructions.

8.2 Purpose limitation
The data importer shall process the personal data only for the specific purpose(s) of the transfer, as set out in Annex I.B, unless on further instructions from the data exporter.

8.3 Transparency
On request, the data exporter shall make a copy of these Clauses, including the Appendix as completed by the Parties, available to the data subject free of charge. To the extent necessary to protect business secrets or other confidential information, including the measures described in Annex II and personal data, the data exporter may redact part of the text of the Appendix to these Clauses prior to sharing a copy, but shall provide a meaningful summary where the data subject would otherwise not be able to understand the content or exercise his/her rights. On request, the Parties shall provide the data subject with the reasons for the redactions, to the extent possible without revealing the redacted information. This Clause is without prejudice to the obligations of the data exporter under Articles 13 and 14 of Regulation (EU) 2016/679.

8.4 Accuracy
If the data importer becomes aware that the personal data it has received is inaccurate, or has become outdated, it shall inform the data exporter without undue delay. In this case, the data importer shall cooperate with the data exporter to erase or rectify the data.

8.5 Duration of processing and erasure or return of data
Processing by the data importer shall only take place for the duration specified in Annex I.B. After the end of the provision of the processing services, the data importer shall, at the choice of the data exporter, delete all personal data processed on behalf of the data exporter and certify to the data exporter that it has done so, or return to the data exporter all personal data processed on its behalf and delete existing copies. Until the data is deleted or returned, the data importer shall continue to ensure compliance with these Clauses. In case of local laws applicable to the data importer that prohibit return or deletion of the personal data, the data importer warrants that it will continue to ensure compliance with these Clauses and will only process it to the extent and for as long as required under that local law. This is without prejudice to Clause 14, in particular the requirement for the data importer under Clause 14(e) to notify the data exporter throughout the duration of the contract if it has reason to believe that it is or has become subject to laws or practices not in line with the requirements under Clause 14(a).

8.6 Security of processing
(a) The data importer and, during transmission, also the data exporter shall implement appropriate technical and organisational measures to ensure the security of the data, including protection against a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access to that data (hereinafter “personal data breach”). In assessing the appropriate level of security, the Parties shall take due account of the state of the art, the costs of implementation, the nature, scope, context and purpose(s) of processing and the risks involved in the processing for the data subjects. The Parties shall in particular consider having recourse to encryption or pseudonymisation, including during transmission, where the purpose of processing can be fulfilled in that manner. In case of pseudonymisation, the additional information for attributing the personal data to a specific data subject shall, where possible, remain under the exclusive control of the data exporter. In complying with its obligations under this paragraph, the data importer shall at least implement the technical and organisational measures specified in Annex II. The data importer shall carry out regular checks to ensure that these measures continue to provide an appropriate level of security.

(b) The data importer shall grant access to the personal data to members of its personnel only to the extent strictly necessary for the implementation, management and monitoring of the contract. It shall ensure that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

(c) In the event of a personal data breach concerning personal data processed by the data importer under these Clauses, the data importer shall take appropriate measures to address the breach, including measures to mitigate its adverse effects. The data importer shall also notify the data exporter without undue delay after having become aware of the breach. Such notification shall contain the details of a contact point where more information can be obtained, a description of the nature of the breach (including, where possible, the categories and approximate number of data subjects and personal data records concerned), its likely consequences, and the measures taken or proposed to address the breach including, where appropriate, measures to mitigate its possible adverse effects. Where, and in so far as, it is not possible to provide all information at the same time, the initial notification shall contain the information then available and further information shall, as it becomes available, subsequently be provided without undue delay.

(d) The data importer shall cooperate with and assist the data exporter to enable the data exporter to comply with its obligations under Regulation (EU) 2016/679, in particular to notify the competent supervisory authority and the affected data subjects, taking into account the nature of processing and the information available to the data importer. 

8.7 Sensitive data
Where the transfer involves personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, or biometric data for the purpose of uniquely identifying a natural person, data concerning health or a person’s sex life or sexual orientation, or data relating to criminal convictions and offences (hereinafter “sensitive data”), the data importer shall apply the specific restrictions and/or additional safeguards described in Annex I.B.

8.8 Onward transfers
The data importer shall only disclose the personal data to a third party on documented instructions from the data exporter. In addition, the data may only be disclosed to a third party located outside the European Union (in the same country as the data importer or in another third country, hereinafter “onward transfer”) if the third party is or agrees to be bound by these Clauses, under the appropriate Module, or if:

(a) the onward transfer is to a country benefitting from an adequacy decision pursuant to Article 45 of Regulation (EU) 2016/679 that covers the onward transfer;

(b) the third party otherwise ensures appropriate safeguards pursuant to Articles 46 or 47 Regulation of (EU) 2016/679 with respect to the processing in question;

(c) the onward transfer is necessary for the establishment, exercise or defense of legal claims in the context of specific administrative, regulatory or judicial proceedings; or

(d) the onward transfer is necessary in order to protect the vital interests of the data subject or of another natural person.

Any onward transfer is subject to compliance by the data importer with all the other safeguards under these Clauses, in particular purpose limitation.

8.9 Documentation and compliance
(a) The data importer shall promptly and adequately deal with enquiries from the data exporter that relate to the processing under these Clauses.

(b) The Parties shall be able to demonstrate compliance with these Clauses. In particular, the data importer shall keep appropriate documentation on the processing activities carried out on behalf of the data exporter.

(c) The data importer shall make available to the data exporter all information necessary to demonstrate compliance with the obligations set out in these Clauses and at the data exporter’s request, allow for and contribute to audits of the processing activities covered by these Clauses, at reasonable intervals or if there are indications of non- compliance. In deciding on a review or audit, the data exporter may take into account relevant certifications held by the data importer.

(d) The data exporter may choose to conduct the audit by itself or mandate an independent auditor. Audits may include inspections at the premises or physical facilities of the data importer and shall, where appropriate, be carried out with reasonable notice.

(e) The Parties shall make the information referred to in paragraphs (b) and (c), including the results of any audits, available to the competent supervisory authority on request.

Clause 9
Use of sub-processors

9.1 GENERAL WRITTEN AUTHORISATION The data importer has the data exporter’s general authorisation for the engagement of sub-processor(s) from an agreed list. The data importer shall specifically inform the data exporter in writing of any intended changes to that list through the addition or replacement of sub-processors in advance, thereby giving the data exporter sufficient time to be able to object to such changes prior to the engagement of the sub-processor(s). The data importer shall provide the data exporter with the information necessary to enable the data exporter to exercise its right to object.

9.2 Where the data importer engages a sub-processor to carry out specific processing activities (on behalf of the data exporter), it shall do so by way of a written contract that provides for, in substance, the same data protection obligations as those binding the data importer under these Clauses, including in terms of third-party beneficiary rights for data subjects.^[1] The Parties agree that, by complying with this Clause, the data importer fulfils its obligations under Clause 8.8. The data importer shall ensure that the sub-processor complies with the obligations to which the data importer is subject pursuant to these Clauses.

[1] This requirement may be satisfied by the sub-processor acceding to these Clauses under the appropriate Module, in accordance with Clause 7.

9.3 The data importer shall provide, at the data exporter’s request, a copy of such a sub-processor agreement and any subsequent amendments to the data exporter. To the extent necessary to protect business secrets or other confidential information, including personal data, the data importer may redact the text of the agreement prior to sharing a copy.

9.4 The data importer shall remain fully responsible to the data exporter for the performance of the sub-processor’s obligations under its contract with the data importer. The data importer shall notify the data exporter of any failure by the sub-processor to fulfil its obligations under that contract.

9.5 The data importer shall agree a third-party beneficiary clause with the sub-processor whereby – in the event the data importer has factually disappeared, ceased to exist in law or has become insolvent – the data exporter shall have the right to terminate the sub-processor contract and to instruct the sub-processor to erase or return the personal data.

Clause 10
Data subject rights
(a) The data importer shall promptly notify the data exporter of any request it has received from a data subject. It shall not respond to that request itself unless it has been authorised to do so by the data exporter.

(b) The data importer shall assist the data exporter in fulfilling its obligations to respond to data subjects’ requests for the exercise of their rights under Regulation (EU) 2016/679. In this regard, the Parties shall set out in Annex II the appropriate technical and organisational measures, taking into account the nature of the processing, by which the assistance shall be provided, as well as the scope and the extent of the assistance required.

(c) In fulfilling its obligations under paragraphs (a) and (b), the data importer shall comply with the instructions from the data exporter.

Clause 11
Redress
(a) The data importer shall inform data subjects in a transparent and easily accessible format, through individual notice or on its website, of a contact point authorised to handle complaints. It shall deal promptly with any complaints it receives from a data subject.

(b) In case of a dispute between a data subject and one of the Parties as regards compliance with these Clauses, that Party shall use its best efforts to resolve the issue amicably in a timely fashion. The Parties shall keep each other informed about such disputes and, where appropriate, cooperate in resolving them.

(c) Where the data subject invokes a third-party beneficiary right pursuant to Clause 3, the data importer shall accept the decision of the data subject to:

(i) lodge a complaint with the supervisory authority in the Member State of his/her habitual residence or place of work, or the competent supervisory authority pursuant to Clause 13;

(ii) refer the dispute to the competent courts within the meaning of Clause 18.

(d) The Parties accept that the data subject may be represented by a not-for-profit body, organisation or association under the conditions set out in Article 80(1) of Regulation (EU) 2016/679.

(e) The data importer shall abide by a decision that is binding under the applicable EU or Member State law.

(f) The data importer agrees that the choice made by the data subject will not prejudice his/her substantive and procedural rights to seek remedies in accordance with applicable laws.

Clause 12
Liability
(a) Each Party shall be liable to the other Party/ies for any damages it causes the other Party/ies by any breach of these Clauses.

(b) The data importer shall be liable to the data subject, and the data subject shall be entitled to receive compensation, for any material or non-material damages the data importer or its sub-processor causes the data subject by breaching the third-party beneficiary rights under these Clauses.

(c) Notwithstanding paragraph (b), the data exporter shall be liable to the data subject, and the data subject shall be entitled to receive compensation, for any material or non-material damages the data exporter or the data importer (or its sub-processor) causes the data subject by breaching the third-party beneficiary rights under these Clauses. This is without prejudice to the liability of the data exporter and, where the data exporter is a processor acting on behalf of a controller, to the liability of the controller under Regulation (EU) 2016/679 or Regulation (EU) 2018/1725, as applicable.

(d) The Parties agree that if the data exporter is held liable under paragraph (c) for damages caused by the data importer (or its sub-processor), it shall be entitled to claim back from the data importer that part of the compensation corresponding to the data importer’s responsibility for the damage.

(e) Where more than one Party is responsible for any damage caused to the data subject as a result of a breach of these Clauses, all responsible Parties shall be jointly and severally liable and the data subject is entitled to bring an action in court against any of these Parties.

(f) The Parties agree that if one Party is held liable under paragraph (e), it shall be entitled to claim back from the other Party/ies that part of the compensation corresponding to its / their responsibility for the damage.

(g) The data importer may not invoke the conduct of a sub-processor to avoid its own liability.

Clause 13
Supervision
(a) Where the data exporter is established in an EU Member State: The supervisory authority with responsibility for ensuring compliance by the data exporter with Regulation (EU) 2016/679 as regards the data transfer, as indicated in Annex I.C, shall act as competent supervisory authority.

Where the data exporter is not established in an EU Member State, but falls within the territorial scope of application of Regulation (EU) 2016/679 in accordance with its Article 3(2) and has appointed a representative pursuant to Article 27(1) of Regulation (EU) 2016/679: The supervisory authority of the Member State in which the representative within the meaning of Article 27(1) of Regulation (EU) 2016/679 is established, as indicated in Annex I.C, shall act as competent supervisory authority.

Where the data exporter is not established in an EU Member State, but falls within the territorial scope of application of Regulation (EU) 2016/679 in accordance with its Article 3(2) without however having to appoint a representative pursuant to Article 27(2) of Regulation (EU) 2016/679: The supervisory authority of one of the Member States in which the data subjects whose personal data is transferred under these Clauses in relation to the offering of goods or services to them, or whose behavior is monitored, are located, as indicated in Annex I.C, shall act as competent supervisory authority.

The data importer agrees to submit itself to the jurisdiction of and cooperate with the competent supervisory authority in any procedures aimed at ensuring compliance with these Clauses. In particular, the data importer agrees to respond to enquiries, submit to audits and comply with the measures adopted by the supervisory authority, including remedial and compensatory measures. It shall provide the supervisory authority with written confirmation that the necessary actions have been taken.

SECTION III – LOCAL LAWS AND OBLIGATIONS IN CASE OF
ACCESS BY PUBLIC AUTHORITIES

Clause 14
Local laws and practices affecting compliance with the Clauses
The Parties warrant that they have no reason to believe that the laws and practices in the third country of destination applicable to the processing of the personal data by the data importer, including any requirements to disclose personal data or measures authorising access by public authorities, prevent the data importer from fulfilling its obligations under these Clauses. This is based on the understanding that laws and practices that respect the essence of the fundamental rights and freedoms and do not exceed what is necessary and proportionate in a democratic society to safeguard one of the objectives listed in Article 23(1) of Regulation (EU) 2016/679, are not in contradiction with these Clauses.

The Parties declare that in providing the warranty in paragraph (a), they have taken due account in particular of the following elements:

(a) the specific circumstances of the transfer, including the length of the processing chain, the number of actors involved and the transmission channels used; intended onward transfers; the type of recipient; the purpose of processing; the categories and format of the transferred personal data; the economic sector in which the transfer occurs; the storage location of the data transferred;

(b) the laws and practices of the third country of destination– including those requiring the disclosure of data to public authorities or authorising access by such authorities – relevant in light of the specific circumstances of the transfer, and the applicable limitations and safeguards; 

(c) any relevant contractual, technical or organisational safeguards put in place to supplement the safeguards under these Clauses, including measures applied during transmission and to the processing of the personal data in the country of destination.

The data importer warrants that, in carrying out the assessment under paragraph (b), it has made its best efforts to provide the data exporter with relevant information and agrees that it will continue to cooperate with the data exporter in ensuring compliance with these Clauses.

The Parties agree to document the assessment under paragraph (b) and make it available to the competent supervisory authority on request.

The data importer agrees to notify the data exporter promptly if, after having agreed to these Clauses and for the duration of the contract, it has reason to believe that it is or has become subject to laws or practices not in line with the requirements under paragraph (a), including following a change in the laws of the third country or a measure (such as a disclosure request) indicating an application of such laws in practice that is not in line with the requirements in paragraph (a).

Following a notification pursuant to paragraph (e), or if the data exporter otherwise has reason to believe that the data importer can no longer fulfil its obligations under these Clauses, the data exporter shall promptly identify appropriate measures (e.g. technical or organisational measures to ensure security and confidentiality) to be adopted by the data exporter and/or data importer to address the situation. The data exporter shall suspend the data transfer if it considers that no appropriate safeguards for such transfer can be ensured, or if instructed by the competent supervisory authority to do so. In this case, the data exporter shall be entitled to terminate the contract, insofar as it concerns the processing of personal data under these Clauses. If the contract involves more than two Parties, the data exporter may exercise this right to termination only with respect to the relevant Party, unless the Parties have agreed otherwise. Where the contract is terminated pursuant to this Clause, Clause 16(d) and (e) shall apply.

Clause 15
Obligations of the data importer in case of access by public authorities
15.1 Notification

(a) The data importer agrees to notify the data exporter and, where possible, the data subject promptly (if necessary with the help of the data exporter) if it:

(i) receives a legally binding request from a public authority, including judicial authorities, under the laws of the country of destination for the disclosure of personal data transferred pursuant to these Clauses; such notification shall include information about the personal data requested, the requesting authority, the legal basis for the request and the response provided; or

(ii) becomes aware of any direct access by public authorities to personal data transferred pursuant to these Clauses in accordance with the laws of the country of destination; such notification shall include all information available to the importer.

(b) If the data importer is prohibited from notifying the data exporter and/or the data subject under the laws of the country of destination, the data importer agrees to use its best efforts to obtain a waiver of the prohibition, with a view to communicating as much information as possible, as soon as possible. The data importer agrees to document its best efforts in order to be able to demonstrate them on request of the data exporter.

(c) Where permissible under the laws of the country of destination, the data importer agrees to provide the data exporter, at regular intervals for the duration of the contract, with as much relevant information as possible on the requests received (in particular, number of requests, type of data requested, requesting authority/ies, whether requests have been challenged and the outcome of such challenges, etc.).

(d) The data importer agrees to preserve the information pursuant to paragraphs (a) to (c) for the duration of the contract and make it available to the competent supervisory authority on request.

(e) Paragraphs (a) to (c) are without prejudice to the obligation of the data importer pursuant to Clause 14(e) and Clause 16 to inform the data exporter promptly where it is unable to comply with these Clauses.

15.2 Review of legality and data minimisation

(a) The data importer agrees to review the legality of the request for disclosure, in particular whether it remains within the powers granted to the requesting public authority, and to challenge the request if, after careful assessment, it concludes that there are reasonable grounds to consider that the request is unlawful under the laws of the country of destination, applicable obligations under international law and principles of international comity. The data importer shall, under the same conditions, pursue possibilities of appeal. When challenging a request, the data importer shall seek interim measures with a view to suspending the effects of the request until the competent judicial authority has decided on its merits. It shall not disclose the personal data requested until required to do so under the applicable procedural rules. These requirements are without prejudice to the obligations of the data importer under Clause 14(e).

(b) The data importer agrees to document its legal assessment and any challenge to the request for disclosure and, to the extent permissible under the laws of the country of destination, make the documentation available to the data exporter. It shall also make it available to the competent supervisory authority on request.

(c) The data importer agrees to provide the minimum amount of information permissible when responding to a request for disclosure, based on a reasonable interpretation of the request.

SECTION IV – FINAL PROVISIONS

Clause 16
Non-compliance with the Clauses and termination

(a) The data importer shall promptly inform the data exporter if it is unable to comply with these Clauses, for whatever reason.

(b) In the event that the data importer is in breach of these Clauses or unable to comply with these Clauses, the data exporter shall suspend the transfer of personal data to the data importer until compliance is again ensured or the contract is terminated. This is without prejudice to Clause 14(f).

(c) The data exporter shall be entitled to terminate the contract, insofar as it concerns the processing of personal data under these Clauses, where:

(i) the data exporter has suspended the transfer of personal data to the data importer pursuant to paragraph (b) and compliance with these Clauses is not restored within a reasonable time and in any event within one month of suspension;

(ii) the data importer is in substantial or persistent breach of these Clauses; or

(iii) the data importer fails to comply with a binding decision of a competent court or supervisory authority regarding its obligations under these Clauses.

In these cases, it shall inform the competent supervisory authority of such non-compliance. Where the contract involves more than two Parties, the data exporter may exercise this right to termination only with respect to the relevant Party, unless the Parties have agreed otherwise.

(d) Personal data that has been transferred prior to the termination of the contract pursuant to paragraph(c) shall at the choice of the data exporter immediately be returned to the data exporter or deleted in its entirety. The same shall apply to any copies of the data. The data importer shall certify the deletion of the data to the data exporter. Until the data is deleted or returned, the data importer shall continue to ensure compliance with these Clauses. In case of local laws applicable to the data importer that prohibit the return or deletion of the transferred personal data, the data importer warrants that it will continue to ensure compliance with these Clauses and will only process the data to the extent and for as long as required under that local law.

(e) Either Party may revoke its agreement to be bound by these Clauses where (i) the European Commission adopts a decision pursuant to Article 45(3) of Regulation (EU) 2016/679 that covers the transfer of personal data to which these Clauses apply; or (ii) Regulation (EU) 2016/679 becomes part of the legal framework of the country to which the personal data is transferred. This is without prejudice to other obligations applying to the processing in question under Regulation (EU) 2016/679.

Clause 17
Governing law
These Clauses shall be governed by the law of the EU Member State in which the data exporter is established. Where such law does not allow for third-party beneficiary rights, they shall be governed by the law of another EU Member State that does allow for third-party beneficiary rights. The Parties agree that this shall be the law of Romania.

Clause 18
Choice of forum and jurisdiction

(a) Any dispute arising from these Clauses shall be resolved by the courts of an EU Member State.

(b) The Parties agree that those shall be the courts of Romania.

(c) A data subject may also bring legal proceedings against the data exporter and/or data importer before the courts of the Member State in which he/she has his/her habitual residence.

(d) The Parties agree to submit themselves to the jurisdiction of such courts.

ANNEXES

ANNEX I
A. LIST OF PARTIES
B. DESCRIPTION OF TRANSFER
C. COMPETENT SUPERVISORY AUTHORITY

ANNEX II
TECHNICAL AND ORGANISATIONAL MEASURES INCLUDING TECHNICAL AND ORGANISATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA

ANNEX III
LIST OF SUBPROCESSORS

ANNEX IV
SWITZERLAND

ANNEX I

A. LIST OF PARTIES

Data exporter(s):

1. Name: Customer, as identified in the Service Agreement to which this Appendix B, and its associated Personal Data Processing Agreement, is appended, on behalf of itself and its affiliated companies to the extent located in the European Union and listed in the Service Agreement.

Address
Contact person’s name, position and contact details: Refer to Service Agreement.

Activities relevant to the data transferred under these Clauses: Customer, has appointed the data importer to provide certain advisory, due diligence and/or vetting reports for regulatory purposes, and/or other specified purposes. To facilitate the provision of these services, the data exporters may provide to the data importer access to the personal data described in Annex I.B, below.

Signature and date: This Appendix A is signed by, and on the date of, the Customer’s signature to the Service Agreement to which this Appendix A, and its associated Personal Data Processing Agreement, is appended.

Role (controller/processor): Controller

Data importer(s):

1. Name: Exiger entity referenced in the Service Agreement.

Address: Address provided in the Service Agreement.

Contact person’s name, position and contact details:
Clewin McPherson,
Chief Information Security Officer
+1 212-455-9400
data.protection@exiger.com

Activities relevant to the data transferred under these Clauses: The data importer(s) is a member of the Exiger corporate group and provides the services specified in the Service Agreement. The data importer(s) will process personal data received from the data exporter(s) in order to provide the specific services as described in the Service Agreement.

Signature and date: This Appendix A is signed by, and on the date of, Exiger’s signature to the Service Agreement to which this Appendix A, and its associated Personal Data Processing Agreement, is appended.

Role (controller/processor): Processor

 
B. DESCRIPTION OF TRANSFER

Categories of data subjects whose personal data is transferred
See Appendix A to the Personal Data Processing Agreement

Categories of personal data transferred
See Appendix A to the Personal Data Processing Agreement

Sensitive data transferred (special categories of personal data)
See Appendix A to the Personal Data Processing Agreement

Applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures.

The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis).

Personal data is transferred on a continuous basis from data exporter to data importer for as long as data importer provides services to the data exporter pursuant to the Service Agreement.

Nature of the processing
See Appendix A to the Personal Data Processing Agreement

Purpose(s) of the data transfer and further processing
See Appendix A to the Personal Data Processing Agreement

The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period

The personal data will be retained for the duration of data importer(s)’ performance of services pursuant to the Service Agreement and for as long thereafter as permitted by the Service Agreement unless data importer(s) is/are required by law to delete the personal data sooner.

For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing

I, applicable,Data importer intends to use the following sub-processor(s) to assist in the performance of its services:

Name of sub-processor: To be provided separately, if applicable.
• Subject Matter:
• Nature of the processing:
• Duration of the processing:

C. COMPETENT SUPERVISORY AUTHORITY

Identify the competent supervisory authority/ies in accordance with Clause 13

The applicable Supervisory Authority(ies) is the Supervisory Authority in the country or region where the data exporter(s) is located:

Austria
Österreichische Datenschutzbehörde
Barichgasse 40-421030 Wien
Tel.+43 1 52 152-0
Email: dsb@dsb.gv.at
Website: http://www.dsb.gv.at

Belgium

Autorité de la protection des données – Gegevensbeschermingsautoriteit (APD-GBA)
Rue de la Presse 35 – Drukpersstraat 351000 Bruxelles – Brussel
Tel.+32 2 274 48 00
Fax+32 2 274 48 35
Email: contact@apd-gba.be
Website: https://www.autoriteprotectiondonnees.be
https://www.gegevensbeschermingsautoriteit.be

The competence for complaints is split among different data protection supervisory authorities in Belgium. Competent authorities can be identified according to the list provided here:

https://www.autoriteprotectiondonnees.be/citoyen/l-autorite/autres-autorites
https://www.gegevensbeschermingsautoriteit.be/burger/de-autoriteit/andere-autoriteiten

Bulgaria
Commission for Personal Data Protection
2, Prof. Tsvetan Lazarov blvd.1592 Sofia
Tel.+359 2 915 3580+359 2 915 3548
Fax+359 2 915 3525
Email: kzld@cpdp.bg
Website: https://www.cpdp.bg

Croatia
Croatian Personal Data Protection Agency
Selska Cesta 13610000 Zagreb
Tel.+385 1 4609 000
Fax+385 1 4609 099
Email: azop@azop.hr
Website: http://www.azop.hr

Cyprus
Commissioner for Personal Data Protection
1 Iasonos Street, P.O. Box 233781082 Nicosia
Tel.+357 22 818 456
Fax+357 22 304 565
Email: commissioner@dataprotection.gov.cy
Website: http://www.dataprotection.gov.cy

Czech Republic
Office for Personal Data Protection
Pplk. Sochora 27170 00 Prague 7
Tel.+420 234 665 111
Fax+420 234 665 444
Email: posta@uoou.cz
Website: http://www.uoou.cz

Denmark
Datatilsynet
Carl Jacobsens Vej 352500 Valby
Tel.+45 33 1932 00
Email: dt@datatilsynet.dk
Website: http://www.datatilsynet.dk

Estonia
Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon)
Tatari 3910134 Tallinn
Tel.+372 6828 712
Email: info@aki.ee
Website: http://www.aki.ee

Finland
Office of the Data Protection Ombudsman
P.O. Box 800FI-00531 Helsinki
Tel.+358 29 56 66700
Fax+358 29 56 66735
Email: tietosuoja@om.fi
Website: http://www.tietosuoja.fi/en

France
Commission Nationale de l’Informatique et des Libertés – CNIL
3 Place de Fontenoy
TSA 80715 – 75334 Paris, Cedex 07
Tel. +33 1 53 73 22 22
Fax +33 1 53 73 22 00
Contact: https://www.cnil.fr/en/contact-cnil
Website: http://www.cnil.fr/

Germany
Der Bundesbeauftragte für den Datenschutz und die Informationsfreiheit
Graurheindorfer Straße 15353117 Bonn
Tel.+49 228 997799 0
Fax+49 228 997799 5550
Email: poststelle@bfdi.bund.de
Website: http://www.bfdi.bund.de

The competence for complaints is split among different data protection supervisory authorities in Germany. Competent authorities can be identified according to the list provided under www.bfdi.bund.de/anschriften.

Greece
Hellenic Data Protection Authority
Kifisias Av. 1-311523 Ampelokipi Athens
Tel.+30 210 6475 600
Fax+30 210 6475 628
Email: contact@dpa.gr
Website: http://www.dpa.gr

Hungary
Hungarian National Authority for Data Protection and Freedom of Information
Falk Miksa utca 9-11H-1055 Budapest
Tel.+36 1 3911 400
Email: privacy@naih.hu
Website: http://www.naih.hu

Iceland
Persónuvernd
Rauðarárstígur 10105 Reykjavík
Tel.+354 510 9600
Email: postur@dpa.is
Website: https://www.personuvernd.is/information-in-english/nr/436

Ireland
Data Protection Commission
21 Fitzwilliam SquareD02 RD28 Dublin 2
Tel.+353 76 110 4800
Email: info@dataprotection.ie
Website: http://www.dataprotection.ie

Italy
Garante per la protezione dei dati personali
Piazza Venezia, 1100187 Roma
Tel.+39 06 69677 1
Fax+39 06 69677 785
Email: segreteria.stanzione@gpdp.it
Website: http://www.garanteprivacy.it

Latvia
Data State Inspectorate
Elijas Street 17LV-1050 Riga
Tel.+371 6722 3131
Fax+371 6722 3556
Email: info@dvi.gov.lv
Website: http://www.dvi.gov.lv

Liechtenstein
Data Protection Authority, Principality of Liechtenstein
Städtle 389490 Vaduz
Tel.+423 236 6090
Email: info.dss@llv.li
Website: https://www.datenschutzstelle.li

Lithuania
State Data Protection Inspectorate
L. Sapiegos str. 17LT-10312 Vilnius
Tel.+370 5 271 2804+370 5 279 1445
Fax+370 5 261 9494
Email: ada@ada.lt
Website: https://vdai.lrv.lt

Luxembourg
Commission Nationale pour la Protection des Données
15, Boulevard du JazzL-4370 Belvaux
Tel.+352 2610 60 1
Fax+352 2610 60 6099
Email: info@cnpd.lu
Website: http://www.cnpd.lu

Malta
Office of the Information and Data Protection Commissioner
Second Floor, Airways HouseHigh StreetSLM 1549 Sliema
Tel.+356 2328 7100
Fax+356 2328 7198
Email: idpc.info@idpc.org.mt
Website: http://www.idpc.org.mt

Netherlands
Autoriteit Persoonsgegevens
Bezuidenhoutseweg 30P.O. Box 933742509 AJ Den Haag/The Hague
Tel.+31 70 888 8500
Fax+31 70 888 8501
Website: https://autoriteitpersoonsgegevens.nl

Norway
Datatilsynet
Tollbugata 30152 Oslo
Tel.+47 22 39 69 00
Email: postkasse@datatilsynet.no
Website: https://www.datatilsynet.no

Poland
Urząd Ochrony Danych Osobowych (Personal Data Protection Office)
ul. Stawki 200-193 Warsaw
Tel.+48 22 531 03 00
Email: kancelaria@uodo.gov.pl;
dwme@uodo.gov.pl
Website: https://uodo.gov.pl

Portugal
Comissão Nacional de Proteção de Dados – CNPD
Av. D. Carlos I, 134, 1º1200-651 Lisboa
Tel.+351 21 392 84 00
Fax+351 21 397 68 32
Email: geral@cnpd.pt
Website: http://www.cnpd.pt

Romania
The National Supervisory Authority for Personal Data Processing
B-dul Magheru 28-30Sector 1 BUCUREŞTI
Tel.+40 31 805 9211
Fax+40 31 805 9602
Email: anspdcp@dataprotection.ro
Website: http://www.dataprotection.ro

Slovakia
Office for Personal Data Protection of the Slovak Republic
Hraničná 12820 07 Bratislava 27
Tel.+ 421 2 32 31 32 14
Fax+ 421 2 32 31 32 34
Email: statny.dozor@pdp.gov.sk
Website: http://www.dataprotection.gov.sk

Slovenia
Information Commissioner of the Republic of Slovenia
Dunajska 221000 Ljubljana
Tel.+386 1 230 9730
Fax+386 1 230 9778
Email: gp.ip@ip-rs.si
Website: https://www.ip-rs.si

Spain
Agencia Española de Protección de Datos (AEPD)
C/Jorge Juan, 628001 Madrid
Tel.+34 91 266 3517
Fax+34 91 455 5699
Email: internacional@aepd.es
Website: https://www.aepd.es

Sweden
Integritetsskyddsmyndigheten
Drottninggatan 295th FloorBox 8114104 20 Stockholm
Tel.+46 8 657 6100
Fax+46 8 652 8652
Email: imy@imy.se
Website: http://www.imy.se

Switzerland
Office of the Federal Data Protection and Information Commissioner FDPIC
Feldeggweg 1
CH – 3003 Berne
Tel.: +41 (0)58 462 43 95 (mon.-fri., 10-12 am)
Fax: +41 (0)58 465 99 96
Email: info@edoeb.admin.ch
Website: https://www.edoeb.admin.ch/edoeb/en/home.html

ANNEX II – TECHNICAL AND ORGANISATIONAL MEASURES
INCLUDING TECHNICAL AND ORGANISATIONAL MEASURES TO
ENSURE THE SECURITY OF THE DATA

Description of the technical and organisational measures implemented by the data importer(s) (including any relevant certifications) to ensure an appropriate level of security, taking into account the nature, scope, context and purpose of the processing, and the risks for the rights and freedoms of natural persons.

I. ORGANIZATIONAL MEASURES

A. Information Security Governance
Data importer has established a personnel structure for information security governance, including but not limited to, a designated employee with overall responsibility for information security government (e.g., a chief information security officer) and other personnel with assigned roles and responsibilities for information security. Roles and responsibilities have been formally defined for all members of the information security team and have been documented.

B. Administrative Access Controls

1. Access Authorization And Workforce Clearance: An employee or contractor will be authorized to access personal data (“Authorized Users”) only if the individual is deemed trustworthy based upon prior service to the data importer or the successful completion of a background check where permitted by applicable law. Data importer permits Authorized Users to access personal data only on a need-to-know basis and only as necessary to perform assigned job responsibilities.
   
2. Confidentiality Agreement: Before establishing access for an Authorized User, data importer requires that the Authorized User execute a confidentiality agreement that applies to the personal data or otherwise acknowledges an obligation of confidentiality.
   
3. Access Establishment: Data importer separates functions between those authorized to assign access rights and those authorized to establish access to data importer’s information systems.
   
4. Review Of Access Rights: On at least a quarterly basis and when an Authorized User changes positions, data importer reviews and, if necessary, revises or terminates the Authorized User’s rights of access to workstations, programs and processes to limit the Authorized User’s access to personal data to the minimum necessary to perform assigned job functions. Data importer will delete any personal data stored on the Authorized User’s computer that no longer is needed by the Authorized User in his or her new position.
   
5. Denial Of Access To Terminated Authorized Users: Upon termination of any Authorized User’s relationship with data importer, data importer promptly does the following: (a) terminates the Authorized User’s rights to access personal data and obtains the return of any devices (such as tokens or key cards) used to obtain access to personal data; (b) obtains the return of all keys, key cards, and other devices that permit access to physical locations containing personal data in paper form; (c) ensures that the terminated Authorized User does not have unescorted access to areas containing personal data in paper form; (d) ensures that all personal data is removed from any computer equipment used by the terminated Authorized User before re-issuing that equipment to another Authorized User.

C. Training

Data importer provides (a) initial training to relevant personnel on how to implement and comply with its information security program, including identifying and reporting a personal data breach, and (b) periodic refresher training and security awareness reminders. Data importer permits newly hired Authorized Users to access personal data only after completion of the initial data security training.

D. Security Incident Response

Data importer has created a security incident response team (SIRT) with assigned roles and responsibilities. Data importer has implemented procedures for identifying security incidents, including personal data breaches, and a plan for responding to security incidents. Data importer periodically tests the security incident response plan. Data importer has established a mechanism for employees to report security incidents, including suspected and actual personal data breaches. Data importer requires all employees to immediately report the loss, theft, or other misuse of any equipment on which personal data is stored.

II. TECHNICAL MEASURES

6. Evaluation And Monitoring

1. Risk Assessment: Data importer has conducted an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity and availability of personal data. Data importer has implemented policies and procedures to reduce risks and vulnerabilities to personal data to a reasonable and appropriate level. These policies and procedures are designed to protect the confidentiality, integrity and availability of personal data and to prevent accidental or unauthorized use, disclosure, alteration, loss or destruction.
   
2. Evaluation Of Security Policies And Procedures: Data importer periodically reviews and, if necessary, updates the policies and procedures described above, as necessary in response to environmental or operational changes affecting the security of personal data.

E. System Activity Review

1. Establishment Of Monitoring Procedures: Data importer has (a) enabled logging on computer systems that store personal data; (b) implemented a process for the review of exception reports and/or logs, and (c) developed and documented procedures for the retention of monitoring data.
   
2. Monitoring Of System Activity: Data importer periodically reviews information system activity records — including audit logs, access reports, privileged operations, error logs on servers, and security incident tracking reports, and changes to systems security — to ensure that implemented security controls are effective and that personal data has not been potentially compromised. Monitoring includes (a) reviewing changes affecting systems handling authentication, authorization, and auditing; (b) reviewing privileged access to production systems processing personal data; and (c) engaging third parties to perform network vulnerability assessments and penetration testing on a regular basis.
   
3. Compliance Review And Third-Party Audits: Data importer periodically reviews compliance with security policies and procedures. Data importer engages a third party, at least annually, to perform an independent audit which includes an assessment of data importer’s information security program. Data importer will make the third-party audit report available to data exporter upon request.

F. Protections Against Malicious Actors

1. Network Security: Data importer maintains an up-to-date firewall and intrusion detection software. Data importer engages in security patch management to ensure that security patches are installed as soon as is reasonably practicable.
   
2. Anti-Malware Protection: Data importer ensures that protections against malicious software (e.g., anti-virus protection, spyware detection software, etc.) are installed before computers and other devices are connected to any of data importer’s networked systems. The software is kept current.
   

G. Technical Access Controls

1. Unique User ID/Secure Passwords: All Authorized Users will be assigned a unique user ID and will be required to create a strong/complex password, or to use a biometric identifier, to access data importer’s network. Systems requiring entry of a password suppress, mask or otherwise obscure the password so that it cannot be viewed by an unauthorized person. All passwords are encrypted while in storage. Authorized Users are required to change passwords on a regular basis. Authorized Users are prohibited form sharing passwords with any other person.
   
2. Access Restrictions: Data importer has implemented technical controls so that each Authorized User will be able to gain access only to those categories of personal data to which access is necessary to perform assigned job responsibilities.
   
3. Encryption: Data importer encrypts personal data in transit, using Transport Layer Security (TLS) encryption. Data importer encrypts personal data at rest using 256-bit AES encryption or stronger. Mobile devices and portable electronic storage media used to store personal data must be encrypted.
   
4. Remote Access: Data importer permits remote access to its networks only via a Virtual Private Network (“VPN”) or a similar secure means
   
5. Secure Disposal: Data importer has established procedures for the secure and permanent destruction of personal data stored in paper and electronic form.
   

H. Contingency Planning

1. Back-Ups: Data importer backs up personal data on a regular schedule (e.g., at least every 24 hours). Back-ups are encrypted and stored in a location physically apart from the primary storage. Back-ups permit prompt restoration of personal data in the event of a disaster.
   
2. Business Continuity/Disaster Recovery: Data importer has developed and maintains a business continuity/disaster recovery plan to ensure that data importer can promptly resume service and restore data exporter’s access to personal data in the event of a physical or technical incident occurrence (for example, fire, ransomware attack, vandalism, system failure, pandemic flu, and natural disaster).
   

I. Change and Configuration Management
Data importer maintains policies and procedures for managing changes to production systems, applications, and databases processing personal data and for documenting the changes.

III. PHYSICAL SAFEGUARDS

1. Data importer’s facilities where personal data are physically secured against unauthorized access by, for example, keys, access cards, receptionists, and/or security guards. Data importer requires that all employees where a security badge at all time while on data importer’s premises. Guests and service providers must register at the reception area and are prohibited from unescorted access to data importer’s facility.
   
2. All servers and network equipment containing personal data are maintained in a location subject to controlled physical access. Only authorized employees may have unescorted access to secure areas where servers and network equipment are located. Video surveillance cameras monitor secured areas where servers and other network equipment are located.
   
3. Only authorized employees may have unescorted access to areas with computers and other electronic resources that permit access to personal data. Access is restricted by a proximity card or key, receptionist, or some similar method. Physical access rights must be promptly terminated when an employee no longer needs physical access to areas containing electronic resources that permit access to personal data
   
4. Data exporter requires authorized employees to ensure that all electronic resources permitting access to personal data, including peripherals (computers, monitors, laptop computers, printers, digital cameras, projectors, etc.) that are assigned to, or regularly used by, them are maintained and used in a manner consistent with their function and such that the possibility of damage and/or loss is minimized.
   
5. Except for equipment designed to be portable, such as laptops, computer equipment used to access personal data should not be removed from data importer’s premises without prior authorization.
   

IV. PERSONAL DATA MANAGEMENT
A. Data Minimization
Data importer has subjected its systems and applications used to process personal data to a review for compliance with privacy-by-design and privacy-default principles and has applied the results of that review to the design of its systems and applications that process personal data. Data importer’s systems and applications have been designed to collect, use, disclose, and otherwise process the minimum personal data necessary to provide the services that are the subject of the Parties’ underlying agreement. Data importer’s systems and applications have been programmed to automatically delete personal data in accordance with data exporter’s data retention schedules or data retention instructions unless data importer is required by law to retain personal data for a longer period of time.

B. Accountability
Data importer maintains a record of processing activities (“ROPA”) that complies with GDPR, art. 30, with respect to its processing of personal data received form, or created or received on behalf of, data exporter. Data importer makes each relevant ROPA available to data exporter upon request.

C. Data Subject Rights

1. Correction/Update Of Personal Data: Data importer provides self-help options through its website to allow data subjects to correct and update their personal data and/or provides multiple methods (e.g., chat bot, webform, e-mail address) by which data subjects may submit requests to correct and update of their personal data.
   
2. Erasure: Data importer has established internal procedures and technical mechanisms to ensure that personal data can be permanently deleted from production systems and back-ups in response to a request from a data subject, if and to the extent required by GDPR, art. 17.
   
3. Data Portability: Data importer has implemented procedures and systems that allow data importer to identify Personal Data provided by the data subject and to transfer that personal data, in a usable form, to a third party at the data subject’s direction or to the data subject directly or by way of a storage medium.

ANNEX III – LIST OF SUB-PROCESSORS

The controller has authorised the use of the following sub-processors:
[To Be Provided Under Separate Cover]

ANNEX IV – SWITZERLAND

Standard Contractual Clauses For The Transfer Of Personal Data From Switzerland To Third Countries
Controller to Processor Transfers

In its communication of August 27, 2021, the Swiss Federal Data Protection and Information Commissioner (“FDPIC”) recognised the new SCCs issued by the European Commission in accordance with Regulation (EU) 2016/679 as a legal basis for personal data transfers to a country without an adequate level of data protection, provided that the necessary adaptations and amendments are made for use under Swiss data protection law. Subsequently on August 31, 2022, the FDPIC announced that the new Federal Act on Data Protection of September 25, 2020 (“nFADP”) will enter into force on September 1, 2023. For the purpose of processing of personal data subject to the nFADP, references to the GDPR shall be deemed to be references to the nFADP.

The Standard Contractual Clauses for the Transfer of Personal Data from Switzerland to Third Countries incorporate by reference the Standard Contractual Clauses in this Appendix B and its Annexes I through III for personal data processed by Exiger on behalf of Customers located in Switzerland, except that, when transferring Swiss personal data to a third country:

(a) all references to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (“GDPR”) must be understood and interpreted as references to the nFADP in the context of data transfers abroad that are subject to the nFADP;

(b) any reference to a supervisory authority shall refer to the Swiss Federal Data Protection and Information Commissioner (“FDPIC”);

(c) in the event of a data breach, prompt notification to the FDPIC shall be made;

(d) references to a “member state” or to the “EU” in the SCCs shall be deemed to include Switzerland;

(e) appointment of sub processors require the controller’s approval; and

(f) with regards to Clauses 17 and 18, these clauses shall be governed by the law of Switzerland and the Customer and Exiger agree to the jurisdictions of the courts of Switzerland with regard to any disputes that arise from these Clauses.

 
Appendix C to the Service Agreement

Terms for Processing Personal Data on behalf of Customers in the United Kingdom when the Exiger entity that will be providing services is located outside of the EEA, UK, or Switzerland. Addendum to the EU Standard Contractual Clauses in Appendix B.

International Data Transfer Addendum
to the
EU Commission Standard Contractual Clauses
Part 1: Tables

Table 1: Parties

Start date	The date provided in the Service Agreement to which this Appendix C and associate Personal Data Processing Agreement are appended.
The Parties	Exporter (who sends the Restricted Transfer)	Importer (who receives the Restricted Transfer)
Parties’ details	Customer as defined the Service Agreement to which this Appendix C and associated Personal Data Processing Agreement are appended, on behalf of itself and its affiliated companies to the extent located in the UK Main address: Customer’s Address Official registration number (if any) (company number or similar identifier):  Customer’s registration number	Exiger Entity Trading name (if different): Main address (if a company registered address):       Official registration number (if any) (company number or similar identifier):
Key Contact	Full Name: Customer Contact Job Title: Contact details including email: Customer email address	Full Name: Bradley Trent Job Title: VP & Global Head of Compliance Contact details including email: data.protection@exiger.com
Signature (if required for the purposes of Section ‎2)

Table 2: Selected SCCs, Modules and Selected Clauses

Addendum EU SCCs

The version of the Approved EU SCCs, Appendix B, which this Addendum is appended to, detailed below, including the Appendix Information: Date:

Table 3: Appendix Information

“Appendix Information” means the information which must be provided for the selected modules as set out in the Appendix of the Approved EU SCCs (other than the Parties), and which for this Addendum is set out in:

Annex 1A: List of Parties: Exiger Entities

Annex 1B: Description of Transfer: Transfer of Personal Data between Exiger Entities for legitimate purposes to facilitate certain necessary transactions.

Annex II: Technical and organisational measures including technical and organisational measures to ensure the security of the data: Parties shall comply with responsibilities under the Data Transfer Agreement including EU SCCs

Annex III: List of Sub processors (Modules 2 and 3 only): As provided in the Data Processing Agreement

Table 4: Ending this Addendum when the Approved Addendum Changes

Ending this Addendum when the Approved Addendum changes

Which Parties may end this Addendum as set out in Section ‎19: X Importer X Exporter

Part 2: Mandatory Clauses
Entering into this Addendum

1. Each Party agrees to be bound by the terms and conditions set out in this Addendum, in exchange for the other Party also agreeing to be bound by this Addendum.
   
2. Although Annex 1A and Clause 7 of the Approved EU SCCs require signature by the Parties, for the purpose of making Restricted Transfers, the Parties may enter into this Addendum in any way that makes them legally binding on the Parties and allows data subjects to enforce their rights as set out in this Addendum. Entering into this Addendum will have the same effect as signing the Approved EU SCCs and any part of the Approved EU SCCs.
   
   Interpretation of this Addendum
   
3. Where this Addendum uses terms that are defined in the Approved EU SCCs those terms shall have the same meaning as in the Approved EU SCCs. In addition, the following terms have the following meanings:

Addendum This International Data Transfer Addendum which is made up of this Addendum incorporating the Addendum EU SCCs.
Addendum EU SCCs The version(s) of the Approved EU SCCs which this Addendum is appended to, as set out in Table 2, including the Appendix Information.
Appendix Information As set out in Table ‎3.
Appropriate Safeguards The standard of protection over the personal data and of data subjects’ rights, which is required by UK Data Protection Laws when you are making a Restricted Transfer relying on standard data protection clauses under Article 46(2)(d) UK GDPR.
Approved Addendum The template Addendum issued by the ICO and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022, as it is revised under Section 18.
Approved EU SCCs The Standard Contractual Clauses set out in the Annex of Commission Implementing Decision (EU) 2021/914 of 4 June 2021.
ICO The Information Commissioner.
Restricted Transfer A transfer which is covered by Chapter V of the UK GDPR.
UK The United Kingdom of Great Britain and Northern Ireland.
UK Data Protection Laws All laws relating to data protection, the processing of personal data, privacy and/or electronic communications in force from time to time in the UK, including the UK GDPR and the Data Protection Act 2018.
UK GDPR As defined in section 3 of the Data Protection Act 2018.

4. This Addendum must always be interpreted in a manner that is consistent with UK Data Protection Laws and so that it fulfils the Parties’ obligation to provide the Appropriate Safeguards.
   
5. If the provisions included in the Addendum EU SCCs amend the Approved SCCs in any way which is not permitted under the Approved EU SCCs or the Approved Addendum, such amendment(s) will not be incorporated in this Addendum and the equivalent provision of the Approved EU SCCs will take their place.
   
6. If there is any inconsistency or conflict between UK Data Protection Laws and this Addendum, UK Data Protection Laws applies.
   
7. If the meaning of this Addendum is unclear or there is more than one meaning, the meaning which most closely aligns with UK Data Protection Laws applies.
   
8. Any references to legislation (or specific provisions of legislation) means that legislation (or specific provision) as it may change over time. This includes where that legislation (or specific provision) has been consolidated, re-enacted and/or replaced after this Addendum has been entered into.
   
   Hierarchy
   
9. Although Clause 5 of the Approved EU SCCs sets out that the Approved EU SCCs prevail over all related agreements between the parties, the parties agree that, for Restricted Transfers, the hierarchy in Section 10 will prevail.
   
10. Where there is any inconsistency or conflict between the Approved Addendum and the Addendum EU SCCs (as applicable), the Approved Addendum overrides the Addendum EU SCCs, except where (and in so far as) the inconsistent or conflicting terms of the Addendum EU SCCs provides greater protection for data subjects, in which case those terms will override the Approved Addendum.
    
11. Where this Addendum incorporates Addendum EU SCCs which have been entered into to protect transfers subject to the General Data Protection Regulation (EU) 2016/679 then the Parties acknowledge that nothing in this Addendum impacts those Addendum EU SCCs.
    
    Incorporation of and changes to the EU SCCs
    
12. This Addendum incorporates the Addendum EU SCCs which are amended to the extent necessary so that:
    
    a. together they operate for data transfers made by the data exporter to the data importer, to the extent that UK Data Protection Laws apply to the data exporter’s processing when making that data transfer, and they provide Appropriate Safeguards for those data transfers;
    
    b. Sections ‎9 to ‎11 override Clause 5 (Hierarchy) of the Addendum EU SCCs; and
    
    c. this Addendum (including the Addendum EU SCCs incorporated into it) is (1) governed by the laws of England and Wales and (2) any dispute arising from it is resolved by the courts of England and Wales, in each case unless the laws and/or courts of Scotland or Northern Ireland have been expressly selected by the Parties.
    
13. Unless the Parties have agreed alternative amendments which meet the requirements of Section 12, the provisions of Section 15 will apply.
    
14. No amendments to the Approved EU SCCs other than to meet the requirements of Section ‎12 may be made.
    
15. The following amendments to the Addendum EU SCCs (for the purpose of Section ‎12) are made:
    a. References to the “Clauses” means this Addendum, incorporating the Addendum EU SCCs;
    
    b. In Clause 2, delete the words:
    
    “and, with respect to data transfers from controllers to processors and/or processors to processors, standard contractual clauses pursuant to Article 28(7) of Regulation (EU) 2016/679”;
    
    c. Clause 6 (Description of the transfer(s)) is replaced with:
    
    “The details of the transfers(s) and in particular the categories of personal data that are transferred and the purpose(s) for which they are transferred) are those specified in Annex I.B where UK Data Protection Laws apply to the data exporter’s processing when making that transfer.”;
    
    d. Clause 8.7(i) of Module 1 is replaced with:
    
    “it is to a country benefitting from adequacy regulations pursuant to Section 17A of the UK GDPR that covers the onward transfer”;
    
    e. Clause 8.8(i) of Modules 2 and 3 is replaced with:
    
    “the onward transfer is to a country benefitting from adequacy regulations pursuant to Section 17A of the UK GDPR that covers the onward transfer;”
    
    f. f. References to “Regulation (EU) 2016/679”, “Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation)” and “that Regulation” are all replaced by “UK Data Protection Laws”. References to specific Article(s) of “Regulation (EU) 2016/679” are replaced with the equivalent Article or Section of UK Data Protection Laws;
    
    g. References to Regulation (EU) 2018/1725 are removed;
    
    h. References to the “European Union”, “Union”, “EU”, “EU Member State”, “Member State” and “EU or Member State” are all replaced with the “UK”;
    
    i. The reference to “Clause 12(c)(i)” at Clause 10(b)(i) of Module one, is replaced with “Clause 11(c)(i)”;
    
    j. Clause 13(a) and Part C of Annex I are not used;
    
    k. The “competent supervisory authority” and “supervisory authority” are both replaced with the “Information Commissioner”;
    
    l. In Clause 16(e), subsection (i) is replaced with:
    
    “the Secretary of State makes regulations pursuant to Section 17A of the Data Protection Act 2018 that cover the transfer of personal data to which these clauses apply;”;
    
    m. Clause 17 is replaced with:
    
    “These Clauses are governed by the laws of England and Wales.”;
    
    n. Clause 18 is replaced with:
    
    “Any dispute arising from these Clauses shall be resolved by the courts of England and Wales. A data subject may also bring legal proceedings against the data exporter and/or data importer before the courts of any country in the UK. The Parties agree to submit themselves to the jurisdiction of such courts.”; and
    
    o. The footnotes to the Approved EU SCCs do not form part of the Addendum, except for footnotes 8, 9, 10 and 11.
    
    Amendments to this Addendum
    
16. The Parties may agree to change Clauses 17 and/or 18 of the Addendum EU SCCs to refer to the laws and/or courts of Scotland or Northern Ireland.
    
17. If the Parties wish to change the format of the information included in Part 1: Tables of the Approved Addendum, they may do so by agreeing to the change in writing, provided that the change does not reduce the Appropriate Safeguards.
    
18. From time to time, the ICO may issue a revised Approved Addendum which:
    
    a. makes reasonable and proportionate changes to the Approved Addendum, including correcting errors in the Approved Addendum; and/or
    
    b. reflects changes to UK Data Protection Laws;
    
    The revised Approved Addendum will specify the start date from which the changes to the Approved Addendum are effective and whether the Parties need to review this Addendum including the Appendix Information. This Addendum is automatically amended as set out in the revised Approved Addendum from the start date specified.
    
19. If the ICO issues a revised Approved Addendum under Section 18, if any Party selected in Table 4 “Ending the Addendum when the Approved Addendum changes”, will as a direct result of the changes in the Approved Addendum have a substantial, disproportionate and demonstrable increase in:
    
    a its direct costs of performing its obligations under the Addendum; and/or
    b its risk under the Addendum,
    
    and in either case it has first taken reasonable steps to reduce those costs or risks so that it is not substantial and disproportionate, then that Party may end this Addendum at the end of a reasonable notice period, by providing written notice for that period to the other Party before the start date of the revised Approved Addendum.
    
20. The Parties do not need the consent of any third party to make changes to this Addendum, but any changes must be made in accordance with its terms.
    

Alternative Part 2 Mandatory Clauses:
Mandatory Clauses Part 2: Mandatory Clauses of the Approved Addendum, being the template Addendum B.1.0 issued by the ICO and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022, as it is revised under Section ‎18 of those Mandatory Clauses.

Appendix D to the Service Agreement

Other than the terms defined in this Section I, capitalized terms have the definition provided in the Personal Data Processing Agreement to which this Appendix D is appended.

“Discover,” with respect to a Personal Data Breach, means knowledge by any member of Exiger’s workforce — other than the person responsible for the Personal Data Breach — that the Personal Data Breach has occurred.

“Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored or otherwise Processed under this DPA when that Personal Data is in the possession of Exiger or its agents or subcontractors.

“Required By Law” means that an applicable statute, regulation, court order, or legal process, enforceable in a court of law, mandates the conduct.

“Sensitive Personal Data” means Personal Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, data concerning health, sex life, or sexual orientation, genetic data and biometric data when Processed for the purpose of uniquely identifying a natural person, and also includes information about criminal history.

“European Data Processing Agreement” means these Terms for Processing Personal Data within the European Economic Area (“EEA”), Switzerland, and the UK (Appendix D) and its attachments.

Exiger’s Processing Of Personal Data

Nature and Purpose Of Processing of Personal Data. Exiger agrees to Process Personal Data in accordance with Attachment 1, which describes the nature and purpose of the Processing, the type of Personal Data, and the categories of Data Subjects.

Violation Of The Law. Customer will not direct Exiger to Process Personal Data in violation of Exiger’s or Customer’s obligations under applicable data protection law. Exiger will promptly notify Customer if Exiger discovers that Exiger’s compliance with a term or condition of this European Data Processing Agreement has violated, violates, or would violate Exiger’s or Customer’s obligations under applicable law.

Disclosures Of Personal Data As Required By Law. Before Exiger discloses Personal Data as Required By Law, Exiger will, unless prohibited by the legal requirement from doing so, notify Customer and permit Customer reasonable time to exercise its legal options to prevent or limit disclosure of Personal Data before Exiger discloses any Personal Data.

Exiger’s Safeguards For Personal Data

Confidentiality Of Personal Data. Exiger will maintain the confidentiality of all Personal Data. Exiger will permit its employees to Process Personal Data only after undergoing appropriate training and acknowledging their confidentiality obligations with respect to that Personal Data.

Physical, Technical And Organizational Safeguards. Exiger shall maintain an information privacy and security program that includes reasonable and appropriate measures — including technical, physical, and organizational safeguards taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of Processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons — to protect against reasonably foreseeable risks to the security, confidentiality, integrity and resilience of Personal Data, which risks could result in the unauthorized disclosure, access, use, alteration, destruction, loss or other compromise of the Personal Data, including a Personal Data Breach.

Reporting Personal Data Breaches. Exiger will report to Customer any Personal Data Breach discovered by Exiger, as soon as reasonably practicable.

Cooperation in Investigation And Mitigation. Exiger agrees to cooperate with Customer in its investigation of any Personal Data Breach. Exiger will take reasonable and appropriate steps to mitigate the known, adverse effects of a Personal Data Breach.

Exiger’s Assistance With Audits And Requests From Data Subjects

Availability Of Records Of Processing. Exiger will, upon reasonable, written request from Customer, promptly make available to Customer information necessary to demonstrate Customer’s compliance with its obligations established by applicable law.

Information Technology Audits. Upon fifteen (15) business days’ prior written notice, Exiger will permit Customer, directly or through a contractor, to conduct site audits of the information technology used to Process Personal Data and of Exiger’s information security controls for Personal Data. Before commencement of the audit, Customer and, where applicable, Customer’s selected contractor must enter into an appropriate confidentiality agreement with Exiger.

Requests For Impact Assessment Information. Exiger will provide the information reasonably requested by Customer to assist Customer in conducting a data protection impact assessment pursuant to applicable law.

Requests From Data Subjects. Exiger agrees to assist Customer in responding to a request from a Data Subject to exercise their individual rights which may include the right to access, rectify, or erase his/her Personal Data, to restrict or block the Processing of his/her Personal Data or for data portability with respect to his/her Personal Data (“Data Subject Request”). In the event a Data Subject submits a Data Subject Request directly to Exiger, Exiger will notify Customer of the Data Subject Request and will await instructions from Customer regarding its response to the Data Subject Request. Upon receipt of Customer’s written instructions, Exiger will take such action reasonably requested by Customer to assist Customer in responding to the Data Subject Request.

Exiger’s Sub-Processors

Consent To Processing By Sub-Processors. Customer consents to Exiger’s use of the sub-processors identified in [Attachment 2 appended hereto]. Customer consents to Exiger’s engaging additional or different sub-processors to Process Personal Data provided that Exiger notifies Customer of such proposed sub-processor and gives Customer a reasonable opportunity (which shall not exceed ten (10) business days) to object. Exiger shall remain responsible for, and remain liable to, Customer for, the acts and omissions of its sub-processor with regard to their Processing of Personal Data as if they were Exiger’s own acts and omissions. In the event Customer objects to Exiger’s disclosure of Personal Data to a sub-processor, Exiger may terminate this European Data Processing Agreement and the Service Agreement without liability.

Sub-processors’ Physical, Technical And Administrative Safeguards. Exiger will obtain reasonable assurances, in writing, from any sub-processor to whom Exiger discloses Personal Data that the sub-processor will comply with substantially the same restrictions and conditions on Processing Personal Data that this European Data Processing Agreement imposes on Exiger.

Miscellaneous Terms

Modification. The Parties agree to amend this European Data Processing Agreement and/or the Service Agreement from time to time as may be necessary to permit Customer to remain in compliance with applicable law.

 
ATTACHMENT 1: DESCRIPTION OF THE TRANSFER
ATTACHMENT 2: SUB-PROCESSORS

 
ATTACHMENT 1:
DESCRIPTION OF THE TRANSFER

Nature Of Processing By Exiger:

See Appendix A to the Personal Data Processing Agreement

Purposes Of Processing By Exiger:

See Appendix A to the Personal Data Processing Agreement

Categories of Data Subjects Whose Personal Data Is Processed By Exiger:

See Appendix A to the Personal Data Processing Agreement

Categories Of Personal Data Processed By Exiger:

See Appendix A to the Personal Data Processing Agreement

Special Categories Of Personal Data Processed By Exiger (Sensitive Personal Data):

See Appendix A to the Personal Data Processing Agreement

 
ATTACHMENT 2:
SUB-PROCESSORS

Customer agrees to Exiger’s use of the following sub-processors to Process Personal Data:

[To Be Provided Separately]

 
Appendix E to the Service Agreement
California Privacy Rights Act Agreement

AGREEMENT

Commencing on January 1, 2023, the following provisions apply to Exiger’s Collection, retention, use, disclosure, and other handling, (collectively, “processing”) of the Personal Data of Consumers:

a. Definitions: Unless otherwise indicated in this California Privacy Rights Act Agreement (“CPRA Agreement”), the capitalized terms used in this CPRA Agreement shall have the meaning assigned to them in the California Privacy Rights Act (“CPRA”).
6.

i. “Consumer” means a California resident (a) who is a natural person and (b) whose Personal Data is processed by Exiger on behalf of Customer for the purposes of the Service Agreement.

ii. “Categories of Personal Data” or “Category of Personal Data” shall mean the categories or category, respectively, of Personal Information listed in Cal. Civ. Code §1798.140(v)(1).

iii. “CPRA Regulations” shall mean final regulations implementing the CPRA after those regulations go into effect.

iv. “Permitted Subcontractor” means Exiger’s subcontractor that agrees, by written contract, to the same restrictions and prohibitions on the processing of Personal Data that this CPRA Agreement imposes on Exiger.

v. “Personal Data” shall have the definition of “personal information” set forth in the CPRA but shall be limited to the personal information of Consumers.

vi. “Sensitive Personal Data” shall have the definition of “sensitive personal information” set forth in the CPRA but shall be limited to the personal information of Consumers.

b. Compliance With Applicable Law: Exiger shall process Personal Data only (i) in accordance with the CPRA and all other applicable laws and regulations, and (ii) in a manner that provides the same level of protection for Personal Data as the CPRA requires Customer to provide. Customer may take reasonable and appropriate steps to help ensure that Exiger uses Personal Data consistent with the CPRA. Exiger will notify Customer if Exiger determines that it can no longer meet its obligations under the CPRA.

c. Permissible Processing Of Personal Data: Exiger shall process Personal Data only (a) on Customer’s behalf, (b) for Customer’s Business Purposes, and (c) to help Customer respond, pursuant to subparagraph (g), below, to a request by a Consumer to exercise rights under the CPRA; and (d) for any other purpose explicitly permitted under the CPRA or its implementing regulations.

d. Restrictions On Processing Personal Data: Exiger is prohibited from (i) processing Personal Data for any purpose other than to perform the Services, including any other commercial purpose; (ii) otherwise processing Personal Data outside the direct business relationship between Customer and Exiger; (iii) Selling or Sharing Personal Data; (iv) combining Personal Data with personal information that it receives from, or on behalf of, another person or persons, or Collects from its own interaction with a California Consumer (except as permitted by the CPRA’s Regulations); or (v) processing the Personal Data for any other purpose except as permitted by this CPRA Agreement.

e. Restrictions On Disclosure Of Personal Data To Subcontractors: Exiger engages subcontractors to process Personal Data on Exiger’s behalf. Exiger shall not disclose any Personal Data to any subcontractor, or permit any subcontractor to create, process, or receive Personal Data on Exiger’s behalf, unless the subcontractor is a Permitted Subcontractor.

f. Requests By An Individual Directed To Exiger: Exiger shall refer to Customer, within three (3) business days of receipt, any request received by Exiger directly from a Consumer for: (i) deletion, correction, or specific pieces, of Personal Data related to the Consumer retained by the Exiger or the Exiger’s subcontractors; (ii) disclosure regarding the Personal Data about the Consumer, if any, that Exiger Collects, discloses for a Business Purpose, Sells, or Shares; (iii) opt-out of the Sale or Sharing, if any, of the Consumer’s Personal Data; or (iv) restriction of the use or disclosure of Sensitive Personal Data. Exiger shall await instructions from Customer before acting upon any request received directly from a Consumer.

g. Cooperation With Customer’s Response To Requests From Consumers: Within twenty-five (25) days of receiving a request from Customer for assistance in responding to a request by a Consumer to exercise one or more of the rights provided by the CPRA, Exiger shall do the following, as applicable:

i. (A) delete the Consumer’s Personal Data from the Exiger’s records and (B) notify any of its subcontractors and any Third Parties with which Exiger shared the Consumer’s Personal Data to delete the Consumer’s Personal Data unless this proves impossible or involves disproportionate effort;

ii. correct the Consumer’s Personal Data as directed by Customer, unless: (A) the Exiger believes that the Personal Data is already correct, in which case Exiger will provide an explanation in writing to Customer of why the Personal Data is already correct and, if Customer responds by directing Exiger to revise the Personal Data, Exiger revise the Personal Data as directed by Customer; or (B) Exiger warrants, and responds in writing, that the Personal Data is in an archived record that Exiger does not use as a source of accurate Personal Data and does not share with Third Parties;

iii. identify:

A. the Categories of Personal Data, and specific pieces of Personal Data, Collected about the Consumer;

B. the categories of sources from whom the Consumer’s Personal Data is Collected, if the sources are other than Customer;

C. the Business Purpose or Commercial purpose for Collecting, Selling, or Sharing the Consumer’s Personal Data; and

D. the categories of entities or individuals, other than Permitted Subcontractors, to which the Exiger disclosed the Consumer’s Personal Data;

iv. provide Customer with a copy of the specific pieces of Personal Data Collected about the Consumer if Customer does not already have a copy of the specific pieces of Personal Data requested;

v. identify (A) the Consumer’s Categories of Personal Data Sold or Shared, and (B) for each Category of Personal Data Sold or Shared, the entities or individuals to which that Category of Personal Data was Sold or Shared;

vi. identify (A) each entity or individual to whom the Exiger has disclosed the Consumer’s Personal Data for a Business Purpose, (B) the Categories of Personal Data disclosed, and (C) the Business Purpose(s) for the disclosure; and/or

vii. follow Customer’s instructions regarding any limitations on the use or disclosure of the Consumer’s Sensitive Personal Data.

7. Customer will pay Exiger’s charges for providing assistance in responding to a request by a Consumer to exercise one or more of the rights provided by the CPRA, at Exiger’s standard consultancy rates.

Appendix F to the Service Agreement

Terms for Transferring Personal Data from Customers located in Australia or Singapore

1. Definitions

1.1. “Australia and Singapore Data Transfer Agreement” or “ASDTA”: means these Terms for Transferring Personal Data from Customers located in Australia and Singapore (Appendix F).

1.2. “Data Breach”: Any loss or unauthorised use, misuse, interference, copying, modification, disclosure, loss or destruction of, or access to, Personal Data transferred under this ASDTA.

1.3. “Data Exporter”: The Party which transfers Personal Data to the Data Importer under this ASDTA.

1.4. “Data Importer”: The Party which receives Personal Data from the Data Importer for Processing under this ASDTA.

1.1. “Data Protection Law”: Any and all written laws relating to data protection (or are, minimally, relevant to the transfer of Personal Data) which the Data Exporter or the Data Importer (or both) are subject to.

1.2. “Data Sub-Processor”: Any person or legal entity which may be engaged by the Data Importer to assist in the Data Exporter’s Processing of Personal Data on behalf of the Data Exporter.

1.3. “Enforcement Authority”: Any public authority empowered by applicable law to implement and enforce the applicable Data Protection Law subject to any relevant jurisdiction limit.

1.4. “Personal Data”: Any information relating to an identified or identifiable natural person (“Data Subject”) transferred under this ASDTA.

1.5. “Processing”: any operation or set of operations that are performed on Personal Data or on sets of Personal Data, whether or not by automated means, including, for example, collection, use and disclosure of Personal Data.

1.6. “Service Agreement”: The agreement to which this ASDTA is attached under which the Data Importer provides services to the Data Exporter.

2. Obligations of Data Exporter

The Data Exporter warrants, represents and undertakes that:

2.1. The Personal Data has been collected, used, disclosed and transferred to the Data Importer under this ASDTA in accordance with applicable Data Protection Law. To the extent required by applicable Data Protection Law, the Data Subject has been notified of and given consent to the purpose(s) of the collection, use, disclosure and/or transfer of his/her Personal Data.

2.2. Any Personal Data that have been transferred under this ASDTA is accurate and complete to the extent necessary for the purposes identified by the Data Exporter in order to comply with Clause 2.1.

2.3. The Data Exporter shall implement adequate technical and operational measures to ensure the security of the Personal Data during transmission to the Data Importer against any Data Breach.

2.4. The Data Exporter shall respond to enquiries from Data Subjects or Enforcement Authorities regarding the Processing of Personal Data by the Data Importer as required by applicable Data Protection Law, including requests to access or correct Personal Data, unless the Parties have agreed in writing that the Data Importer shall so respond, and such delegation is permitted by applicable Data Protection Law. Responses to such enquiries and requests shall be made within a reasonable time frame or within the time frame and in the manner, if any, required under the applicable Data Protection Law, and shall be complete and accurate.

3. Obligations of Data Importer

The Data Importer warrants, represents and undertakes that:

3.1. The Data Importer shall Process the Personal Data only in compliance with the Service Agreement and for the purposes described in Attachment 1 attached to this ASDTA, and in accordance with applicable Data Protection Law.

3.2. The Data Importer shall not further sell, loan, use, disclose, or transfer the Personal Data it receives from the Data Exporter to another person, Enforcement Authority or legal entity, including to Data Sub-Processors, unless it has notified the Data Exporter of such further disclosure or transfer in writing, and provided reasonable opportunity for the Data Exporter to object. The Data Importer shall not use, disclose or transfer the Personal Data for the purpose of direct marketing unless the consent of the Data Subject has been obtained for that purpose.

3.3. The Data Importer agrees that prior to any disclosure or transfer of Personal Data to Data Sub-Processors, the Data Importer shall pass down substantially the same protections of this ASDTA to the Data Sub-Processor.

3.4. The Data Importer shall promptly communicate and refer to the Data Exporter any enquiries and requests from Data Subjects relating to the Personal Data transferred by the Data Exporter, including requests to access or correct the Personal Data.

3.5. Upon the termination of this ASDTA or completion of Processing required under this ASDTA, the Data Importer shall, at the election of the Data Exporter, either return to the Data Exporter the Personal Data held in its possession pursuant to this ASDTA, or destroy the Personal Data in a manner that renders it unrecoverable. If the Personal Data is to be returned to the Data Exporter then the Data Importer shall dispose of and not retain or store any copy of any part or all of the Personal Data.

3.6. The Data Importer shall have in place reasonable and appropriate technical, administrative, operational, and physical measures, consistent with applicable Data Protection Laws to protect the confidentiality, integrity and availability of Personal Data, in particular against risks of Data Breaches.

3.7. If the Data Importer becomes aware that a Data Breach has occurred affecting Personal Data in its possession or under its control, or in the possession or under the control of an importer of an onward disclosure or transfer of the Personal Data, it shall notify the Data Exporter within 10 business days.

3.8. The Data Importer shall promptly notify and consult with the Data Exporter regarding any investigation regarding the collection, use, transfer, disclosure, security, or disposal of the Personal Data transferred under this ASDTA, unless otherwise prohibited under law.

3.9. The Data Importer shall provide reasonable and prompt assistance to the Data Exporter upon request for the purposes of clause 2.4; and where the Data Importer has agreed in writing, to respond to enquiries and requests from Data Subjects or Enforcement Authorities regarding its Processing of Personal Data when notified by the Data Exporter.

4. Acknowledgment and Reliance

4.1. The Data Importer and the Data Exporter each rely on the warranties, representations and undertakings of the other in entering into this ASDTA, and further acknowledge they are relying on those respective warranties, representations and undertakings in respect of the collection, use, transfer, storage and disposal of Personal Data referred to in this ASDTA.

 
ATTACHMENT 1:
DESCRIPTION OF THE TRANSFER

This Attachment forms part of the Australia and Singapore Data Transfer Agreement.

Data Exporter

The data exporter is:
Customer, as defined in the Service Agreement to which this Appendix F and associated Personal Data Processing Agreement are appended, on behalf of itself and its affiliated companies to the extent located in Australia or Singapore.

Data Importer

The data importer is:
Exiger, as defined in the Service Agreement to which this Appendix F and associated Personal Data Processing Agreement are appended, on behalf of itself and its affiliated companies (a) providing services to data exporter pursuant to the Service Agreement and (b) to the extent located outside of (i) Australia, if the data exporter is located in Australia, or (ii) Singapore, if the data exporter is located in Singapore.

Data Subjects

The Personal Data transferred concern the following categories of Data Subjects:

See Appendix A to the Personal Data Processing Agreement

Categories of Personal Data

The Personal Data transferred concern the following categories of data:

See Appendix A to the Personal Data Processing Agreement

Special categories of Personal Data

The Personal Data transferred concern the following special categories of Personal Data:

See Appendix A to the Personal Data Processing Agreement

Purpose of Processing

See Appendix A to the Personal Data Processing Agreement