Data Processing Addendum

This Data Processing Addendum, including all of its Annexes (this “Addendum“), is a legal agreement between you, either an individual or a legal entity (the “Controller”), and Emcie Co Ltd. (registration number 516987971) (“Processor”), amending and forming part of the Terms of Service of the Processor that apply to and also bind the Controller with relation to its purchase of Processor’s services (such Terms of Service, together with the documents incorporated into them, including this Addendum, the AI Terms and the Privacy Policy, the “Agreement”, and such services, the “Services”). Where the Controller itself acts as a processor on behalf of another business, the Processor acts as the Controller’s subprocessor, and the Controller confirms that it is authorized to give the instructions in this Addendum on behalf of that business. This Addendum applies to Personal Data that the Processor processes on behalf of the Controller as part of the Services; it does not apply to personal information that the Processor processes for its own purposes as a controller (such as account management, billing and service analytics), which is governed by the Processor’s Privacy Policy.

THIS ADDENDUM TAKES EFFECT WHEN CONTROLLER ACCESSES OR USES THE SERVICES. BY ACCESSING OR USING THE SERVICES, CONTROLLER (A) ACKNOWLEDGES THAT CONTROLLER HAS READ AND UNDERSTANDS THIS ADDENDUM; (B) REPRESENTS AND WARRANTS THAT CONTROLLER HAS THE RIGHT, POWER AND AUTHORITY TO ENTER INTO THIS ADDENDUM AND, IF ENTERING INTO THIS ADDENDUM FOR AN ORGANIZATION, THAT YOU HAVE THE LEGAL AUTHORITY TO BIND THAT ORGANIZATION; AND (C) ACCEPTS THIS ADDENDUM AND AGREES THAT CONTROLLER IS LEGALLY BOUND BY ITS TERMS.

In the event that any term or condition contained herein is in conflict with a term or condition set forth in the Terms of Service, the term and condition set forth in this Addendum shall be deemed to be the controlling term and condition, except if otherwise expressly stated and subject to the order of precedence in Section 19.10 of the Terms of Service. Capitalized terms not otherwise defined herein shall have the meaning given to them in the Terms of Service or in applicable Data Protection Legislation.

IF CONTROLLER DOES NOT AGREE TO ANY TERM OR CONDITION OF THIS ADDENDUM, CONTROLLER MAY NOT ACCESS OR USE THE SERVICES.

1. Compliance with Data Protection Legislation

Processor shall comply with all applicable data protection and privacy laws, their implementing regulations, regulatory guidance, and secondary legislation (“Data Protection Legislation”), each as updated or replaced from time to time, including: (i) of the EU – the General Data Protection Regulation ((EU) 2016/679) (the “GDPR”); (ii) of the UK – the UK General Data Protection Regulation ("UK GDPR") and the UK Data Protection Act 2018; (iii) the Privacy and Electronic Communications Directive (2002/58/EC) and any applicable national implementing laws including, as far as applicable, the Privacy and Electronic Communications (EC Directive) Regulations 2003 (SI 2003/2426); (iv) of the U.S. – the California Consumer Privacy Act, as amended (“CCPA”); and (v) any other laws that apply.

2. Processing of Personal Data

2.1. Details of Processing. Annex A sets out the scope, nature and purpose of processing by the Processor, the duration of the processing and the types of personal data and categories of data subjects.

2.2. Instructions. With relation to its Agreement with the Controller, processing of personal data (including - as applicable and where provided to the Processor - sensitive personal data), as such term is regarded under Data Protection Legislation, of data subjects, that was collected by the Controller or on its behalf and provided to the Processor (“Personal Data”), shall only be done in accordance with the Controller’s instructions as set out in the Agreement and in this Addendum, as otherwise necessary to provide the Services, or as otherwise agreed in writing by the parties hereto. The Processor will immediately inform the Controller if, in its opinion, an instruction violates or would cause Processor to violate Data Protection Legislation. The Processor shall process Personal Data only to fulfill its obligations under the Agreement and as permitted in this Addendum.

2.3. Controller Responsibilities. The Controller will ensure that it has and has placed all necessary consents and notices, respectively, in place to enable lawful transfer of Personal Data to the Processor for the duration and purposes (including processing and use) of this Addendum.

2.4. Requirements from Processor. The Processor acknowledges and agrees that it shall act in the role of a “Processor” (or equivalent term) as defined under the Data Protection Legislation. The Controller discloses Personal Data to the Processor solely for performing the Services, in consideration of permitted business purposes set forth under the Data Protection Legislation while acknowledging that such performance encompasses the permitted uses specified in this Addendum. The Processor is prohibited from: (i) selling or sharing Personal Data; (ii) retaining, using, or disclosing Personal Data for any purpose other than providing the Services to the Controller and as otherwise permitted by Data Protection Legislation; (iii) retaining, using, or disclosing Personal Data for any commercial purpose other than the Services, unless expressly permitted by Data Protection Legislation; (iv) retaining, using, or disclosing Personal Data outside of the direct business relationship between the Controller and the Processor unless expressly permitted by Data Protection Legislation or pursuant to this Addendum; and (v) combining or updating Personal Data with personal data that the Processor obtains from other sources unless expressly permitted by Data Protection Legislation or pursuant to this Addendum. The Processor certifies that it understands the prohibitions outlined in this Section ‎2.4 and will comply with them. The Processor shall notify the Controller no later than five (5) business days after it makes a determination that it can no longer meet its obligations under the Data Protection Legislation or this Addendum. The Processor permits the Controller the right, upon notice, to take reasonable and appropriate steps to stop and remediate the Processor’s unauthorized use of Personal Data.

3. Security

3.1. Security Measures. The Processor shall implement appropriate technical and organizational measures for processing Personal Data which shall, at minimum, meet the requirements in Annex B.

3.2. Breach Notification. The Processor shall notify the Controller without undue delay upon discovery of any breaches involving the security of Personal Data processed by the Processor or any of Processor’s subprocessors under the Agreement. The notice shall be sent to the Controller’s contact for security notices, which is the Workspace Owner’s registered email address and shall state, to the extent then known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed to address it, and the Processor’s contact point for further information. Where this information is not yet all known, the Processor shall provide it in stages as it becomes available, without further undue delay.

3.3. Personnel. The Processor shall ensure that all Processor and subprocessor personnel who process (including having access to) Personal Data are made aware of their obligation to keep such information confidential. All Processor employees and contractors with access to Personal Data are subject to confidentiality obligations.

4. Permitted Uses of Personal Data

4.1. “Controller Data” means the prompts, agent configurations, conversation (Session) data and interactions, source code, deployment settings, logs and other data that the Controller (including anyone acting on the Controller’s behalf) enters into, connects to or otherwise makes available to the Processor’s software or the Services. As part of the Services, and solely for the purpose of providing the Services to the Controller, the Processor processes Controller Data in order to: (a) build, deploy and host the Controller’s agents where hosting is provided by the Services, and connect agents that the Controller runs elsewhere; (b) receive, store, display and search (including by natural-language search) agent Sessions and related usage information, so that the Controller can observe, investigate and analyze its agents, subject to the limits of its plan (including an approximate location, for example a city or region, that the Processor derives from the IP address of a person who chats with the Controller’s agent, saves with the Session and shows to the Controller); (c) generate AI-assisted outputs for the Controller, such as Session titles and summaries and responses of the Coparlant assistant; (d) inspect source-code repositories that the Controller connects, in order to suggest build and deployment settings; (e) store and display build, deployment and runtime logs, and store deployment settings and secrets; and (f) secure, support and maintain the Services. Where AI-assisted features are used, the Processor may send the relevant Controller Data to third-party AI providers engaged as subprocessors in accordance with Section 8. The Controller Data may contain Personal Data, including when it is sent to an AI provider under Section 8. The Processor does not promise that Controller Data is de-identified or anonymized before it is processed to provide the Services. De-identification under this Addendum means removing or replacing identifying details; it does not by itself make data anonymous. Pseudonymized data (identifiers replaced with codes, where a person can still be identified using other information) remains Personal Data and remains subject to this Addendum. Data is anonymous only if it can no longer identify a person under the applicable Data Protection Legislation. The Controller acknowledges and agrees to the foregoing, and hereby expressly grants the Processor the right and permission to perform the actions required for the processing described in this Section 4.1.

4.2. The Processor confirms that Personal Data provided by Controller within the Controller Data shall be used by Processor solely in connection with the processing described in Section 4.1 and shall not be used by Processor for any other purpose not expressly permitted in this Addendum.

4.3. In the event that the Controller does not have relevant valid legal basis and/or did not obtain a consent necessary to grant the Processor any of the rights or permissions concerning a permitted use – the Controller will refrain from providing the Processor the data for which it does not have necessary valid legal basis and/or the required consent.

5. Assistance

5.1. Cooperation with the Controller. The Processor shall promptly provide all information and assistance reasonably requested by the Controller, at the Controller’s expense, to respond to any request from a data subject and to comply with its obligations under the Data Protection Legislation with respect to security, breach notifications, privacy impact assessments, litigation, inquiries or consultations with supervisory authorities or regulators. The Processor’s assistance shall not be unreasonably withheld. The expense referred to in this Section is for the Controller only and is not a charge to an individual who exercises rights. Requests for assistance are made in writing to [email protected]. The Processor shall confirm that it has received the request and keep the Controller informed of progress.

5.2. Third-Party Requests. The Processor shall promptly inform the Controller of any data subject’s request or any communications from a regulator, government body, supervisory authority, or litigant relating to Personal Data provided to the Processor by the Controller that the Processor or its subprocessors receive, unless applicable law prohibits providing such information. The Processor shall not respond to such requests except as instructed by the Controller, unless required by Data Protection Legislation, in which case the Processor shall, to the extent permitted by the applicable legislation, inform the Controller of such legal requirement prior to responding to such request, in order to provide the Controller with the opportunity to fully pursue available legal remedies, including the right to contest or object to such requests. Where an individual sends the Processor a request about Personal Data that the Processor processes on behalf of the Controller, the Processor shall tell the individual that the request concerns data held for a customer and should be sent to that customer, and shall pass the request to the Controller where the Controller can be identified, unless applicable law prohibits it.

6. Deletion of Personal Data

The Processor shall delete the Personal Data that it still holds for the Controller, and copies thereof in its active systems, within ninety (90) days after termination of the Agreement (which includes the deletion of the Controller’s Workspace under Section 13.5 of the Terms of Service) unless required by applicable law to store the Personal Data, in which case the Processor shall inform the Controller of that obligation and comply with the requirements of the Data Protection Legislation until the Personal Data is securely deleted. The cancellation of a paid Plan, the deletion of a single Project and the closing of a User Account are not termination of the Agreement for this Section; deletion of a Project is dealt with in Section 13.5(b) of the Terms of Service, and export before deletion in Section 13.5(e) of the Terms of Service. Deletion of a Workspace may take several stages, as described in Section 13.5(c) of the Terms of Service. This Section applies to Personal Data that the Processor processes on behalf of the Controller. It does not apply to analytics or session-replay data that Emcie collects as a controller for its own purposes (see the Privacy Policy). Turning off analytics stops future collection and does not delete data already collected, and requests about that data are handled under the Privacy Policy. It also does not apply to conversations and logs that Emcie keeps as a controller for its own usability-improvement and safety purposes for 24 months after the last activity in the Workspace concerned, which are handled under the Privacy Policy. Requests for deletion are made in writing to [email protected]. A request to delete a user’s own data must be sent from that user’s registered email address. A request to delete shared Workspace data must be authorised by an Owner of the Workspace concerned, and the Processor may verify the identity and authority of the requester before acting. These rules on who may make or authorise a request do not change ordinary dashboard exports or any right that an individual has under Data Protection Legislation. The Processor shall handle requests made under this Section without undue delay and within the time limits that apply under applicable law. When the Processor has finished handling a request, it shall email the requester a confirmation of what was deleted and identify anything that is retained and the reason for its retention. The end of the period for which a Session remains available in the Service and the deletion of a Workspace are not by themselves a completed deletion request, and do not by themselves show that every copy, including copies held by subprocessors and generated data such as titles and summaries, has been deleted. Deleting a Project in the dashboard is likewise not a request for deletion under this Section, which is made separately to [email protected]. A Plan’s “not private” label does not by itself permit the Processor to disclose Personal Data publicly, to use it to train AI models, or to disregard Data Protection Legislation or a valid request under this Section. On the Controller’s written request after deletion, the Processor shall confirm in writing whether deletion has been completed and identify any Personal Data that it keeps because applicable law requires it. The Processor does not return Personal Data to the Controller on termination or on request. The Controller can use the ordinary per-Session exports described in Section 13.5(e) of the Terms of Service while it has access to the Service; they do not by themselves cover all Personal Data that the Processor processes for the Controller, and the Processor does not offer a complete return of all Personal Data on request or promise that the full dataset remains retained or recoverable. That is separate from the duty in the first sentence of this Section, which applies to Personal Data that the Processor still holds for the Controller when the Agreement terminates; Personal Data that is no longer held, for example because it has expired or been deleted, is not returned and is not promised to be restorable. A Controller may request removal of Personal Data as described above. Nothing in this Section removes any right of access, portability or other right that an individual may have under Data Protection Legislation.

7. Recordkeeping and Verification

7.1. Recordkeeping. The Processor shall maintain records and information in accordance with applicable Data Protection Legislation to demonstrate its compliance with this Addendum (the “Records”).

7.2. Verification. The Processor shall make available to Controller, following written request, all Records and information necessary to demonstrate compliance with this Addendum and the Data Protection Legislation, and shall cooperate with verifications, including inspections, by the Controller or its third-party auditors in relation to the processing of Personal Data. A verification shall be requested in writing and shall be limited to the Records, systems and personnel relevant to the Personal Data processed for the Controller. It shall be carried out so as not to compromise the security of the Processor’s systems or the confidentiality of other customers’ data, shall not give access to other customers’ data, and shall be subject to reasonable confidentiality undertakings by the Controller and its auditors. The Processor may first respond with Records, written answers or existing independent assurance material where these answer the request. This paragraph does not limit any audit right that the Controller or a supervisory authority has under the Data Protection Legislation or the Standard Contractual Clauses. The Controller shall give at least thirty (30) days’ written notice of a verification. A verification may be requested no more than once in any twelve (12) month period, unless a supervisory authority requires it or it follows a breach affecting the Controller’s Personal Data. Each party bears its own costs of a verification. On-site access is not provided unless the Data Protection Legislation or a supervisory authority requires it.

8. Subprocessors

8.1. Appointment of Subprocessors. The Controller authorizes the Processor to have and appoint subprocessors in accordance with this section ‎8 and any restrictions in this Addendum, to process Personal Data on behalf of the Processor in connection with the Services. The Processor is required to have a written agreement with each subprocessor containing data protection obligations not less protective than those in this Addendum.

8.2. Existing Subprocessors. The Processor may continue to use those subprocessors already engaged by the Processor as of the date of this Addendum (as listed at https://parlant.io/subprocessors), for processing Personal Data on behalf of the Processor in connection with the Services.

8.3. Objection Right for New Subprocessors. The Processor shall give the Controller thirty (30) days’ prior written notice of the appointment of any new subprocessor, including full details of the processing to be undertaken by that subprocessor. If, within such notice period, the Controller notifies the Processor in writing of any objections (on reasonable documented grounds) to the proposed appointment, the Processor shall not appoint (or disclose any Personal Data to) that proposed subprocessor until reasonable steps have been taken to address the objections raised by the Controller and the Controller has been provided with a reasonable written explanation of the steps taken. If the Processor is unable to take such steps to avoid the processing of Personal Data by the objected-to subprocessor within a reasonable period of time, which shall not exceed thirty (30) calendar days, or the Controller does not approve the changes proposed by the Processor, the Controller may at the option of the Controller, by providing written notice to the Processor, terminate the Agreement or the Service(s) which cannot be provided by the Processor without the use of the objected-to subprocessor.

8.4. Liability regarding subprocessors. The Processor shall be liable for the acts and omissions of its subprocessors to the same extent the Processor would be liable if performing the services of such subprocessor directly under the terms of this Addendum, subject to Section 10.3.

9. International Transfers of Personal Data

9.1. General Obligation. The Processor shall comply with all applicable requirements for cross-border transfers of Personal Data under Data Protection Legislation. The Processor shall be deemed the “data importer” and the Controller the “data exporter” under the appropriate transfer mechanism(s) identified in this clause ‎9. Unless expressly agreed in a separate written agreement between the Controller and the Processor, the Processor does not commit to store or process Personal Data only in a particular country or region.

9.2. Transfer from Processor to subprocessors. The Controller grants the Processor a mandate to execute the Standard Contractual Clauses with any relevant subprocessor it appoints on its behalf.

10. Miscellaneous

10.1. Interpretation. Any words following the terms “including” and similar expressions shall not limit the sense of the words preceding those terms.

10.2. Entire Agreement. This Addendum shall replace and supersede any existing data processing addendum (including any privacy addendums), attachment or exhibit (including any standard contractual clauses) between the parties, except for any standard contractual clauses or other transfer safeguard that the parties have validly entered into, which remain in force until a valid replacement is in place, and except as provided for in section ‎9.2, if applicable. Any addenda, attachments, or exhibits related to security shall remain in place and supplement any security measures set out in Annex B. In the event of a conflict between Annex B and any other agreement that the Processor has entered into with the Controller governing information security, including administrative, physical, or technical safeguards regarding the protection of data, the provisions more protective of the data shall prevail.

10.3. Liability. The liability of each party under this Addendum shall be subject to the exclusions and limitations of liability set out in the Agreement. These exclusions and limitations do not apply to, or limit, liability under any standard contractual clauses incorporated under Section 9, which is governed by the liability provisions of those clauses, or liability to data subjects, or any other liability that cannot be limited under Data Protection Legislation.

10.4. Governing Law and Jurisdiction. This Addendum will be governed by and construed in accordance with the governing law and jurisdiction provisions in the Agreement, unless required otherwise by applicable Data Protection Legislation.

10.5. Termination of Addendum. This Addendum will terminate on the later of the termination or expiry of the Agreement or the end of the processing of all Personal Data.

Last Updated: November 1, 2026ANNEX APERSONAL DATA PROCESSING PURPOSES AND DETAILS

DESCRIPTION OF PROCESSING

Categories of data subjects whose Personal Data is processed

The Controller may submit Personal Data to the Processor with relation to the provision of the Services, the extent of which is determined and controlled by the Controller in its sole discretion, and which may include, but is not limited to personal data of data subjects relating to the following categories:

Customers, business partners and vendors of the Controller (who are natural persons)
Employees and contact persons (both of whom are natural persons) of the Controller’s customers, business partners and vendors
Employees, agents, advisors, contractors, and any users authorized by the Controller to use the Services (who are natural persons); only to the extent their Personal Data is contained in Controller Data. Information about Authorized Users that the Processor uses for account management, billing and service analytics is processed by the Processor as a controller under its Privacy Policy and is not covered by this Addendum.
End Users and other individuals who communicate with agents that the Controller builds or operates using the Services, or whose data is otherwise contained in Controller Data (who are natural persons). The Processor does not verify the age or identity of these individuals and does not restrict their age except as applicable law requires. Children may be among them; the Controller is responsible for its use of the Services in relation to them, as stated in Section 2.5 of the Terms of Service.

Categories of Personal Data processed

First and last name
Title
Position
Employer
Contact information (company, email, phone, physical business address)
ID data
Professional life data
Personal life data
Connection data
Localization data

The categories above include any Personal Data contained in conversation and Session data, source code and repository content, deployment settings, logs and other activity data that the Controller submits or connects, including data sent to AI features.

Sensitive data processed (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures.

The Controller decides whether the Personal Data it submits includes sensitive data, and is responsible for the notices, lawful basis and consents that this requires (Terms of Service, Section 2.5). This Annex does not state that the Processor accepts, or is prepared to process, such data under additional safeguards. This Addendum is not a business associate agreement or other contract specific to healthcare or other regulated data, and no such contract is in place unless the parties have signed one separately.

Annex B sets out general technical and organisational security measures that apply to all Personal Data processed under this Addendum; it is not specific to sensitive data. No additional safeguards for sensitive data are stated in this Addendum.

The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis).

Continuous.

Nature of the processing

The Processor will process Personal Data as necessary to perform the Services pursuant to the Agreement, as further instructed by the Controller (as expressly set forth in the Addendum to which this Annex is attached) in its use of the Services. The nature of the processing includes receiving, storing, hosting, retrieving, displaying, analyzing (including through AI-assisted features), transmitting to subprocessors and deleting Controller Data, as described in Section 4.1 of the Addendum.

Purpose(s) of the processing

The Processor will process Personal Data for the purposes necessary to perform the Services pursuant to the Agreement, as further instructed by the Controller (as expressly set forth in the Addendum to which this Annex is attached) in its use of the Services. Such purposes are the provision, hosting, operation, security, support and maintenance of the Services for the Controller, as described in Section 4.1 of the Addendum.

The period for which the Personal Data will be retained, or, if that is not possible, the criteria used to determine that period

The period which is required in order to provide the Services to the Controller. For session history in the Service, this period is determined by the retention limits of the Controller’s subscription plan (by age and number of sessions), as set out in the Agreement and the Documentation. Availability of a Session in the Service and its physical deletion from the Processor’s systems are separate: traces, logs and sessions follow separate cleanup stages. The end of a plan retention period and the deletion of a Project in the dashboard are not requests for deletion of Personal Data; a request for deletion is made separately under Section 6 of the Addendum.

For transfers to (sub-)processors, also specify subject matter, nature and duration of the processing

Matter and nature of the processing, as set out in the Agreement, for the duration required for the data importer to provide the Services to the data exporter.

ANNEX BTECHNICAL AND ORGANISATIONAL MEASURES

In the event of a conflict between this Annex and any other agreement that the Processor has entered into with the Controller governing information security, technical and organizational measures, the protection of data and/or privacy, or similar, the provisions more protective of the data, shall prevail.

1. Measures of pseudonymisation and encryption of Personal Data:	- The Processor shall maintain encryption in transit and at rest in accordance with sections 5 and 6 below.
2. Measures for ensuring the ability to restore the availability and access to Personal Data in a timely manner in the event of a physical or technical incident	- Business Continuity Management. The Processor will, establish and maintain business continuity and disaster recovery plans (“Contingency Plans”) for critical functions, technology and systems in support of the Services herein, to support recovery of the Services in the event of a disaster or other unexpected disruption in Services. No Recovery Time or Recovery Point objective is agreed, and nothing in this Annex is a promise of backup, service level or uptime (see Sections 2.11(h) and 14.3 of the Terms of Service).
3. Processes for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures in order to ensure the security of the processing	- The Processor shall maintain processes for testing, assessing and evaluating the effectiveness of technical and organizational controls at a minimum on an annual basis. The results of such assessments shall be documented and remediation actions monitored by the Processor management responsible for the information security governance. This may include accreditations to provide independent assurance that the Processor programs, products and services meet industry standards for security.
4. Measures for user identification and authorization	- Access Control: - Identification and Authentication. All access to any Personal Data shall be Identified and Authenticated. “Identification” refers to processes which establish the identity of the person or entity requesting access to Personal Data. “Authentication” refers to processes which validate the purported identity of the requestor. - For access to Personal Data, the Processor shall require Authentication by the use of an individual, unique user ID and an individual password and/or other appropriate Authentication technique (e.g. soft token, pin, etc.). The Processor shall maintain procedures to ensure the protection, integrity, and soundness of all passwords created by the Processor and/or used by the Processor in connection with the Agreement.
5. Measures for the protection of data during transmission	- Encryption in transit. The Processor shall maintain encryption, in accordance with industry standards, for all transmission of Personal Data via public networks (e.g., the Internet). Such transmissions include, but are not limited to: - Sessions between web browsers and web servers; - Email containing Personal Data; and - Transfer of files via the Internet (e.g., SFTP).
6. Measures for the protection of data during storage	- Encryption at rest. The Processor shall maintain encryption, in accordance with industry standards, for all Personal Data stored on any of Processor storage media.
7. Measures for ensuring physical security of locations at which Personal Data are processed	- The Processor shall maintain physical security of its Personal Data processing facilities and ensure it is designed and applied in accordance with industry standards to protect infrastructure in the event of natural disasters, accidents and malicious attacks. - The Processor relies on the physical security controls of its hosting providers for the facilities in which Personal Data is stored.
8. Measures for ensuring events logging - Event logging. The Processor shall maintain logging, appropriate to the Services, of events relevant to the security of Personal Data, and shall protect log records against unauthorized access and alteration. No specific events, review frequency or retention period are stated in this Annex.
9. Measures for ensuring system configuration, including default configuration	- The Processor shall ensure that default passwords and accounts, and any other default settings that would leave a system insecure, are changed, disabled or removed before operational use. Secure default settings may be kept. Configuration testing shall be included in periodic processes for testing as described in section 3 above.
10. Measures for internal IT and IT security governance and management	- Risk Management. The Processor shall maintain information security risk management program, with the results being included in the annual mitigation plan, which is presented to and monitored by the Processor Management. - Account Administration. The Processor shall maintain appropriate processes for requesting, approving, and administering accounts and access privileges for Processor processing resources and personal data. These processes shall include procedures for granting and revoking emergency access to Personal Data. - Access Control. The Processor shall maintain appropriate access control mechanisms to prevent all unauthorized access to Personal Data. The access and privileges granted shall be limited to the minimum necessary to perform the assigned functions. - Network Security Authorized Access. The Processor shall only have access to Personal Data as authorized by Controller and shall use such access solely for providing services to the Controller. The Processor shall not attempt to access any applications, systems or data which Controller does not request it to access in order to perform its services. The Processor further agrees to access such applications, data and systems solely to the extent minimally necessary to provide services to the Controller. - Endpoint protection. The Processor shall ensure that any endpoint, to whom the Processor provides access to Personal Data, has malware protection installed; in addition, the Processor shall ensure that malware protection cannot be disabled by the end users and has periodic updates of new malware signatures. - Vulnerability Management. The Processor will establish and maintain a vulnerability management program to identify, record and remediate vulnerabilities, based on recognized industry standards.
11. Measures for certification/assurance of processes and products	- No security certification or accreditation is stated as held by the Processor.
12. Measures for ensuring data quality	- Protection of Storage Media. All media on which Personal Data is stored shall be protected against unauthorized access or modification. The Processor shall maintain reasonable and appropriate processes and mechanisms to maintain accountability and tracking of the receipt, removal and transfer of storage media used. - Data Integrity. The Processor shall maintain processes to prevent unauthorized or inappropriate modification of Personal Data, for both data in transit and data at rest.

13. Measures for ensuring accountability

Accountability records. The Processor shall keep records that allow it to show that the measures in this Annex B are applied. The identification and authentication requirements are set out in section 4 and are not repeated here.

14. For transfers to subprocessors, also describe the specific technical and organizational measures to be taken by the subprocessor to be able to provide assistance to the Controller and, for transfers from a processor to a subprocessor, to the data exporter	- Third Parties. The Processor shall ensure that any agent, including a subcontractor/subprocessor, to whom the Processor provides access to Personal Data agrees to maintain reasonable and appropriate safeguards to protect such information.
15. Measures for the de-identification process	- No de-identification or anonymization measure is stated in this Annex (see Section 4.1 of this Addendum).
16. Measures for the anonymization process	- No measure is stated in this Annex.
17. Measures for ensuring that the anonymization process was successful	- No separate measure is stated in this Annex.
18. Measures for prevention of re-identification	- No separate measure is stated in this Annex.