MYNE DATA PROTECTION AGREEMENT

1. DEFINITIONS AND INTERPRETATION

1.1 In this DPA the following terms have the following meanings:

• “Data Protection Laws” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the “GDPR”), Spanish Organic Law 3/2018 of 5 December on the Protection of Personal Data and Guarantee of Digital Rights (the “LOPDGDD”), Spanish Law 34/2002 of 11 July on Information Society Services and Electronic Commerce, to the extent applicable, and any other data protection legislation applicable to the Processing, together with the binding decisions of the Spanish Data Protection Agency (Agencia Española de Protección de Datos, the “AEPD”).
• “Client Personal Data” means the Personal Data made available by or on behalf of Client to MYNE, or otherwise Processed by MYNE on behalf of Client, in connection with the Supplies.
• “Instructions” means the documented instructions of Client for the Processing of Client Personal Data, as set out in Clause 3.4.
• “Sub-processor” means any third party engaged by MYNE to Process Client Personal Data on behalf of Client.
• “SCCs” means the standard contractual clauses for the transfer of personal data to third countries approved by Commission Implementing Decision (EU) 2021/914 of 4 June 2021, or any clauses replacing them.

1.2 The terms “Controller”, “Processor”, “Data Subject”, “Personal Data”, “Personal Data Breach”, “Processing” and “Supervisory Authority” have the meanings given to them in the GDPR. Capitalised terms not defined in this DPA have the meanings given to them in the Terms.

2. SCOPE AND ROLES OF THE PARTIES

2.1 This DPA applies to the Processing of Client Personal Data by MYNE on behalf of Client in the provision of the Supplies. The subject matter, duration, nature and purpose of the Processing, the categories of Personal Data and the categories of Data Subjects are described in Annex I and in the relevant Order.

2.2 Client acts as Controller and MYNE acts as Processor. Where Client acts as Processor on behalf of a third-party Controller, MYNE acts as Sub-processor and Client warrants that it has been duly authorised by that Controller to give the Instructions and to engage MYNE on the terms of this DPA.

2.3 Where an Order provides that MYNE Processes Personal Data on behalf of a Controller other than Client, this DPA shall not apply to that Processing, which shall be governed by the provisions of that Order in accordance with Clause 8 of the Terms.

2.4 MYNE acts as an independent Controller, and not as Processor, in respect of (a) the contact and business data of Client’s representatives and personnel Processed for the management of the contractual relationship, invoicing and communications, and (b) Processing required for MYNE to comply with its own legal obligations. Such Processing is governed by MYNE’s privacy policy, available on its website, and not by this DPA.

3. CLIENT OBLIGATIONS AND INSTRUCTIONS

3.1 Client, as Controller, is solely responsible for the lawfulness of the Processing and warrants and undertakes that throughout the term of this DPA:

1. (a)it has a valid legal basis under Articles 6 and, where applicable, 9 of the GDPR for the Processing of Client Personal Data by MYNE in accordance with the Instructions;
2. (b)it has provided Data Subjects with all information required by Articles 13 and 14 of the GDPR and Article 11 of the LOPDGDD, and has obtained any consents required, including for the disclosure of Client Personal Data to MYNE;
3. (c)Client Personal Data has been collected lawfully, is accurate, adequate and limited to what is necessary for the purposes of the Processing;
4. (d)it shall not make available to MYNE special categories of Personal Data, Personal Data relating to criminal convictions and offences, or Personal Data of minors, unless expressly agreed in an Order together with any additional safeguards required; and
5. (e)the Instructions comply with Data Protection Laws, and it has carried out any data protection impact assessment or prior consultation required under Articles 35 and 36 of the GDPR.

3.2 Client is responsible for responding to Data Subjects, Supervisory Authorities and any other third parties in its capacity as Controller.

3.3 Client shall indemnify and hold MYNE harmless from and against any claims, losses, damages, costs (including reasonable legal fees) and, to the extent permitted by Applicable Law, administrative fines and sanctions, arising out of or in connection with (a) any breach by Client of this Clause 3 or of Data Protection Laws, or (b) the Processing carried out by MYNE in accordance with the Instructions. This indemnity shall not be subject to the limitations of liability set out in Clause 12 of the Terms.

3.4 The Agreement, each Order and this DPA constitute Client's complete and final Instructions at the date of execution. Any additional or amended Instructions must be given in writing, must be consistent with the Agreement and Data Protection Laws, and, where they go beyond the scope of the Supplies or entail additional cost for MYNE, shall be implemented only by means of a Change Order and subject to the corresponding Fees.

4. OBLIGATIONS OF MYNE

4.1 MYNE shall Process Client Personal Data only on the documented Instructions of Client, including with regard to international transfers, unless required to do so by European Union or Member State law to which MYNE is subject, in which case MYNE shall inform Client of that legal requirement before Processing, unless that law prohibits such information on important grounds of public interest.

4.2 MYNE shall inform Client if, in its opinion, an Instruction infringes Data Protection Laws. MYNE is not obliged to perform a legal assessment of the Instructions and shall be entitled to suspend the execution of the relevant Instruction, without liability and without this constituting a breach of the Agreement, until Client confirms or modifies it in writing.

4.3 MYNE shall not Process Client Personal Data for its own purposes, save as permitted under Clause 9 of this DPA, in accordance with Article 33.2 of the LOPDGDD.

4.4 MYNE shall ensure that persons authorised to Process Client Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, in accordance with Article 28.3(b) of the GDPR and Article 5 of the LOPDGDD. This obligation shall survive the termination of this DPA.

4.5 MYNE shall maintain a record of processing activities carried out on behalf of Client in accordance with Article 30.2 of the GDPR and, where required by Data Protection Laws, shall designate a data protection officer and communicate his or her contact details to Client. MYNE's contact point for data protection matters is privacy@mynegroup.com.

5. SECURITY OF PROCESSING

5.1 Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the Processing, as well as the risks for the rights and freedoms of Data Subjects, MYNE shall implement the technical and organisational measures described in Annex II in accordance with Article 32 of the GDPR.

5.2 Client acknowledges that it has reviewed the measures described in Annex II and that they provide an appropriate level of security for the Processing. MYNE may update or modify such measures from time to time, provided that the overall level of security is not materially reduced.

5.3 Client is responsible for the security of its own systems, accounts and credentials, for any Third-Party Environment it provides or controls, and for the secure transmission of Client Personal Data to MYNE.

6. SUB-PROCESSORS

6.1 Client grants MYNE a general written authorisation, in accordance with Article 28.2 of the GDPR, to engage Sub-processors. The Sub-processors listed in each Order, in accordance with Annex III, are deemed approved by Client upon execution of that Order.

6.2 MYNE shall inform Client of any intended addition or replacement of Sub-processors at least fifteen (15) days in advance, by email to the contact person designated by Client in the relevant Order (or, failing such designation, to the signatory of that Order), and shall update the list of Sub-processors accordingly. Client may object in writing within ten (10) days of such notice, only on reasonable and documented grounds relating to data protection. If Client does not object within that period, the change shall be deemed accepted.

6.3 In the event of a justified objection, the Parties shall discuss in good faith a reasonable alternative. If no alternative is agreed within thirty (30) days, MYNE may, at its option, either continue to provide the affected Supplies without the objected Sub-processor, or terminate the affected Order without liability. Client shall pay all Fees accrued until the date of termination.

6.4 MYNE may replace a Sub-processor without prior notice where the replacement is urgently required for reasons of security or business continuity, in which case MYNE shall inform Client as soon as reasonably practicable, and Clause 6.2 shall apply.

6.5 MYNE shall impose on each Sub-processor, by written contract, the same data protection obligations as those set out in this DPA. MYNE shall remain liable to Client for the performance of the Sub-processor's obligations in accordance with Article 28.4 of the GDPR, subject to the limitations of liability set out in Clause 12 of the Terms.

7. INTERNATIONAL DATA TRANSFERS

7.1 MYNE and its Sub-processors may transfer Client Personal Data outside the European Economic Area only where (a) the destination country benefits from an adequacy decision of the European Commission, including the EU-U.S. Data Privacy Framework for certified recipients; (b) appropriate safeguards are in place in accordance with Article 46 of the GDPR, including the SCCs; or (c) a derogation under Article 49 of the GDPR applies.

7.2 Client authorises MYNE to enter into the SCCs (Module 3, processor to processor) with Sub-processors located outside the European Economic Area, where required. Where Client is located outside the European Economic Area, any transfer of Client Personal Data from MYNE to Client shall be governed by the SCCs (Module 4, processor to controller), where required by Data Protection Laws.

7.3 MYNE shall provide reasonable information to enable Client to carry out any transfer impact assessment required. Client remains responsible, as Controller, for assessing the lawfulness of the transfers it instructs.

8. ASSISTANCE TO CLIENT

8.1 Taking into account the nature of the Processing, MYNE shall assist Client by appropriate technical and organisational measures, insofar as possible, in responding to requests from Data Subjects exercising their rights under Chapter III of the GDPR. MYNE shall forward to Client, within five (5) Business Days, any request received directly from a Data Subject in relation to Client Personal Data and shall not respond to it, other than to refer the Data Subject to Client, unless instructed by Client in writing.

8.2 Taking into account the nature of the Processing and the information available to it, MYNE shall provide reasonable assistance to Client in ensuring compliance with its obligations under Articles 32 to 36 of the GDPR.

8.3 MYNE shall inform Client, unless prohibited by law, of any request, inspection or investigation by a Supervisory Authority relating to Client Personal Data.

8.4 Any assistance under this DPA which goes beyond the functionality of the Supplies or requires more than a reasonable effort shall be charged to Client at MYNE's applicable rates, save where the assistance is required as a result of a breach of this DPA by MYNE.

9. ANONYMISED AND AGGREGATED DATA

9.1 Client instructs and authorises MYNE to anonymise Client Personal Data, in accordance with the criteria established by Data Protection Laws and the guidance of the AEPD, so that Data Subjects are no longer identified or identifiable, and to aggregate such data with other data. Client, as Controller, confirms that such anonymisation is compatible with the purposes for which Client Personal Data were collected. Anonymisation shall be carried out in accordance with a documented anonymisation procedure, and MYNE shall periodically review the risk of re-identification.

9.2 Anonymised and aggregated data do not constitute Personal Data and may be used by MYNE for the development, training, calibration, validation and improvement of its Models, products and services, as well as for statistical and benchmarking purposes, during and after the term of the Agreement, provided that such data do not identify Client or any Data Subject and do not disclose Client's Confidential Information. Such data and any results derived from them shall form part of the MYNE IPR.

9.3 Client may object to the use described in Clause 9.2 by expressly so indicating in the relevant Order. Such objection shall apply from the date of execution of that Order and shall not affect data anonymised prior to it.

10. PERSONAL DATA BREACHES

10.1 MYNE shall notify Client without undue delay and, where feasible, within forty-eight (48) hours after becoming aware of a Personal Data Breach affecting Client Personal Data, in accordance with Article 33.2 of the GDPR. The notification shall include, to the extent available to MYNE, the information referred to in Article 33.3 of the GDPR, which may be provided in phases as it becomes available.

10.2 MYNE shall take reasonable measures to contain the Personal Data Breach and mitigate its possible adverse effects, and shall cooperate with Client as reasonably required.

10.3 Client, as Controller, is solely responsible for assessing and making any notification to the Supervisory Authority and to Data Subjects under Articles 33 and 34 of the GDPR. MYNE shall not notify any third party of a Personal Data Breach on behalf of Client unless required by law or instructed in writing by Client.

10.4 The notification of or response to a Personal Data Breach by MYNE shall not be construed as an acknowledgment of fault or liability. Unsuccessful attempts or activities that do not compromise the security of Client Personal Data, including pings, port scans, denial of service attempts and failed log-in attempts, shall not constitute a Personal Data Breach.

10.5 Where a Personal Data Breach is attributable to Client or to a Third-Party Environment not controlled by MYNE, Client shall bear the costs of MYNE's assistance.

11. AUDITS

11.1 MYNE shall make available to Client the information reasonably necessary to demonstrate compliance with Article 28 of the GDPR. MYNE shall first satisfy this obligation by providing, upon written request and not more than once in any twelve (12) month period, its relevant certifications, third-party audit reports, security policies and/or responses to a reasonable security questionnaire.

11.2 Client may carry out an on-site audit or inspection only where (a) the information provided under Clause 11.1 is demonstrably insufficient to verify compliance, (b) it is required by a Supervisory Authority, or (c) following a Personal Data Breach attributable to MYNE. Any such audit shall:

1. (a)be notified at least thirty (30) days in advance, with a proposed scope agreed with MYNE;
2. (b)take place not more than once in any twelve (12) month period, during normal business hours and for no more than two (2) Business Days, without unreasonably disrupting MYNE's operations;
3. (c)be conducted by Client or by an independent auditor who is not a competitor of MYNE and is bound by written confidentiality obligations;
4. (d)not give access to data of other clients of MYNE, to MYNE's trade secrets, source code, Models or algorithms, or to information subject to legal privilege; and
5. (e)be carried out at Client's cost, including MYNE's reasonable costs and the time of its personnel at MYNE's applicable rates, save where the audit reveals a material breach of this DPA by MYNE.

11.3 The results of any audit shall be MYNE Confidential Information. Audits of Sub-processors shall be satisfied by means of the reports and certifications made available by such Sub-processors.

12. RETURN AND DELETION OF PERSONAL DATA

12.1 Upon termination of the provision of the Supplies involving Processing, MYNE shall, at Client's choice notified in writing within thirty (30) days of such termination, delete or return Client Personal Data to Client in a commonly used format, and delete existing copies. Any return of data in a format other than that used by MYNE shall be subject to the corresponding Fees. If Client does not notify its choice within that period, MYNE shall delete Client Personal Data.

12.2 Notwithstanding the foregoing, MYNE may retain Client Personal Data (a) to the extent required by European Union or Member State law, and (b) duly blocked, in accordance with Articles 32 and 33.3 of the LOPDGDD, for as long as liabilities may arise from its relationship with Client, during the applicable limitation periods. Copies held in backup systems shall be deleted in accordance with MYNE's ordinary backup cycles.

12.3 Upon written request, MYNE shall certify the deletion of Client Personal Data.

13. LIABILITY

13.1 The liability of each Party arising out of or in connection with this DPA shall be subject to the exclusions and limitations of liability set out in Clause 12 of the Terms, save as provided in Clause 3.3 of this DPA. Such limitations apply in aggregate to this DPA and to the Agreement and shall not be construed as a separate or additional cap.

13.2 MYNE shall not be liable for any damage, fine or sanction arising from Processing carried out in accordance with the Instructions, from any breach by Client of Data Protection Laws or of this DPA, or from any Third-Party Environment not controlled by MYNE.

13.3 Nothing in this DPA limits the liability of either Party towards Data Subjects where such limitation is not permitted by Article 82 of the GDPR. Where a Party has paid full compensation to a Data Subject for damage for which the other Party is responsible, it shall be entitled to claim back from the other Party that part of the compensation corresponding to its responsibility, in accordance with Article 82.5 of the GDPR.

14. TERM, PRECEDENCE AND GOVERNING LAW

14.1 This DPA shall remain in force for the term of the Agreement and, thereafter, for as long as MYNE Processes Client Personal Data on behalf of Client. The obligations which by their nature are intended to survive, including confidentiality, liability and Clause 12 of this DPA, shall survive its termination.

14.2 In the event of conflict between this DPA and the Agreement in relation to the Processing of Client Personal Data, this DPA shall prevail, save for Clause 12 of the Terms, which shall apply as set out in Clause 13 of this DPA, and save where an Order allocates roles differently in accordance with Clause 8 of the Terms or expressly identifies the provision of this DPA that it modifies, in accordance with Clause 2.3 of the Terms.

14.3 Where a change in Data Protection Laws or a decision of a Supervisory Authority requires an amendment to this DPA, the Parties shall negotiate the necessary amendments in good faith. MYNE may update Annex II and the list of Sub-processors from time to time in accordance with this DPA.

14.4 This DPA shall be governed by Spanish law, and any dispute shall be resolved in accordance with Clause 18 of the Terms.

ANNEX I – DESCRIPTION OF THE PROCESSING

This Annex describes the Processing in general terms. The purpose of the Processing, the categories of Data Subjects and the categories of Personal Data applicable to each Order shall be specified in that Order, which shall complete and form part of this Annex I.

ANNEX II – TECHNICAL AND ORGANISATIONAL SECURITY MEASURES

MYNE shall implement, as a minimum and as appropriate to the nature of the Processing, the following measures:

• Encryption of Personal Data in transit using TLS and encryption of Personal Data at rest.
• Role-based access control, least-privilege principles and strong authentication, with access granted only to named individual users and promptly revoked when no longer required.
• Logging of access to systems, portals and downloads, with logs retained for audit purposes.
• Pseudonymisation and data minimisation where compatible with the purpose of the Processing.
• Logical segregation of Client Personal Data from the data of other clients.
• Backup and recovery procedures designed to ensure the availability and resilience of processing systems.
• Regular security assessments, vulnerability testing and patch management of the components operated by MYNE.
• A documented incident response procedure, including the handling and escalation of Personal Data Breaches.
• Confidentiality commitments and periodic data protection and security training for personnel with access to Personal Data.
• Due diligence and contractual obligations for Sub-processors in accordance with Clause 6.
• Secure deletion of Personal Data upon termination in accordance with Clause 12.

ANNEX III – AUTHORISED SUB-PROCESSORS

The Sub-processors authorised by Client for each Order, together with the service provided, their location and the transfer safeguard applicable under Clause 7, shall be listed in that Order. Any subsequent addition or replacement shall be notified in accordance with Clause 6.2. The current list of Sub-processors is available upon request at privacy@mynegroup.com.