Data Processing Addendum

DATA PROCESSING ADDENDUM (DPA)

This Data Processing Addendum (this "Addendum") forms part of, and is incorporated into, the Master Services Agreement between Joveo, Inc. ("Vendor") and the customer identified in that Order Form (“Company”) (the “Principal Agreement”). It governs Processing of Company Personal Data by Vendor on behalf of Company, including where Company itself acts on behalf of another Controller. In the event of conflict, this Addendum prevails over the Principal Agreement solely with respect to the Processing of Personal Data. Capitalized terms not defined herein have the meanings given in the Principal Agreement.

DEFINITIONS.

• 1. Defined Terms. The following terms have the meanings set out below. Where a term is defined in Data Protection Laws but not in this Addendum, the Data Protection Laws definition applies:

• 1. Interpretation.
     1. “Including” means “including without limitation.”
     2. Where the Data Protection Laws definitions of Controller, Processor, Personal Data, Processing, Special Category Data, Data Subject, and Supervisory Authority are referred to herein, those definitions apply.
     3. Headings are for convenience and do not affect interpretation.

SCOPE, APPLICABILITY AND ROLES.

• 1. Scope. This Addendum applies to any Processing of Company Personal Data by Vendor under or in connection with the Principal Agreement.
  2. Roles. Where Company determines the purposes and means of Processing Company Personal Data, Company acts as Controller and Vendor acts as Processor. Where Company Processes Company Personal Data on behalf of another Controller, Company acts as Processor and Vendor acts as Company’s sub-processor. Company represents that, where it acts as Processor, it is authorized by the applicable Controller to appoint Vendor as a sub-processor and to issue the instructions contemplated by this Addendum. Vendor does not act as an independent Controller with respect to Company Personal Data Processed under this Addendum. The categories of Personal Data, Data Subjects, and the purpose and nature of Processing are described in Appendix 1 (Details of Processing).
  3. Vendor Restrictions. Vendor will not:
     1. sell, rent, release, disclose, or otherwise make available Company Personal Data to any third party for monetary or other valuable consideration;
     2. share Company Personal Data in a manner that constitutes 'sharing' under CCPA/CPRA or an equivalent concept under Applicable US State Privacy Laws;
     3. retain, use, or disclose Company Personal Data for any purpose other than performing the Services and as otherwise expressly permitted under this Addendum and the Principal Agreement;
     4. retain, use, or disclose Company Personal Data outside of the direct business relationship between the Parties; or
     5. combine Company Personal Data with personal information obtained from, or on behalf of, sources other than Company, except as permitted under CCPA/CPRA and Applicable US State Privacy Laws.
  4. Confidentiality of Authorized Personnel: Vendor will ensure that any person it authorizes to Process Company Personal Data is subject to appropriate written confidentiality obligations or statutory/professional duties of confidentiality no less protective than those in this Addendum.
  5. CCPA/US State Lawe Compliance Notice: Vendor will promptly notify Company if Vendor determines that it can no longer meet its obligations under CCPA/CPRA or Applicable US State Privacy Laws, and will cooperate with any reasonable and appropriate steps Company takes to ensure Company Personal Data is used in a manner consistent with Company's obligations under such laws, as further described in Section 10 (Audit and Compliance).

OBLIGATIONS OF THE COMPANY.

• 1. Lawful Basis, Authority and Transparency. Company represents and warrants that: (a) where it acts as Controller, it has established and will maintain a valid legal basis for the Processing and has provided all notices required by Data Protection Laws; and (b) where it acts as Processor, it has authority from the applicable Controller to instruct Vendor and to appoint Vendor as a sub-processor. Company will not instruct Vendor to Process Company Personal Data in a manner that violates Data Protection Laws.
  2. Accuracy and Minimization. Company will ensure that Company Personal Data is accurate, up-to-date, adequate, relevant, and limited to what is necessary for the purposes of the Services.
  3. Instructions. Company will provide Vendor with documented instructions that are lawful and compliant with Data Protection Laws. Where Company acts as Processor, Company will ensure that its instructions to Vendor are consistent with the instructions and authority of the applicable Controller. Company bears responsibility for the lawfulness of its instructions and its authority to issue them.
  4. Special Categories and Sensitive Data. Company will not disclose or instruct Vendor to Process Special Categories of Personal Data or Sensitive Personal Information except to the extent such Processing is supported by the applicable Platform functionality, described in Appendix 1, and permitted under Data Protection Laws with appropriate safeguards and a valid lawful ground.
  5. Data Subject Rights. Where Company acts as Controller, Company is responsible for determining the scope and lawfulness of responses to Data Subject requests, communicating with Data Subjects, and meeting applicable statutory deadlines. Where Company acts as Processor, Company will coordinate such requests with the applicable Controller. Vendor’s obligations to assist Company are set out in Section 8.
  6. Cross-Border Transfers. Each Party is responsible for complying with the transfer restrictions applicable to it under Data Protection Laws. Company will provide information reasonably necessary to determine the applicable transfer mechanism, and Vendor will implement the transfer mechanisms applicable to its Restricted Transfers in accordance with Section 11.
  7. Regulatory Engagement. Where Company acts as Controller, Company is responsible for communications with Supervisory Authorities relating to Company’s Processing, except where Vendor is legally required to communicate directly. Where Company acts as Processor, Company will coordinate regulatory engagement with the applicable Controller. Vendor will provide commercially reasonable assistance as required by Data Protection Laws.
  8. Indemnity for Unlawful Instructions. Company will defend, indemnify, and hold harmless Vendor and its Affiliates, officers, directors, employees, and personnel from and against any third-party claims, damages, losses, liabilities, penalties, fines, costs, and reasonable legal fees arising out of or relating to: (a) Company’s breach of its obligations under this Addendum or applicable Data Protection Laws; (b) any unlawful or unauthorized instruction given by Company to Vendor in connection with the Processing of Company Personal Data; or Company’s failure to obtain any required authorization, consent, lawful basis, or instruction from an applicable Controller where Company acts as a Processor. The foregoing will not apply to the extent the claim, loss, or liability arises from Vendor’s breach of this Addendum or applicable Data Protection Laws.

PROCESSING INSTRUCTIONS.

• 1. Documented Instructions. Vendor will Process Company Personal Data only on Company's documented instructions, as set out in: (a) the Principal Agreement; (b) this Addendum (including Appendix 1); and (c) any additional documented instructions issued by Company consistent with the Principal Agreement and this Addendum.
  2. Permitted Processing. Vendor may Process Company Personal Data only to the extent necessary to: (a) provide, operate, support, configure and troubleshoot the Services for Company; (b) comply with Vendor’s legal obligations under Applicable Laws, subject to Section 4.3; (c) maintain the security, integrity and reliability of the Services, including security monitoring, abuse prevention and fraud prevention; and (d) generate and use aggregated, anonymized or de-identified data as permitted by the Principal Agreement and Data Protection Laws. For clarity, Vendor will not use Company Personal Data to train general-purpose or cross-customer artificial-intelligence or machine-learning models unless expressly agreed in writing by Company. This restriction does not prevent Customer-specific processing necessary to provide the Services or use of aggregated, anonymized or de-identified data permitted by the Principal Agreement and Data Protection Laws.
  3. Legally Required Processing. If Vendor is required by Applicable Laws to Process Company Personal Data other than on Company’s instructions, Vendor will (to the extent permitted by law) notify Company before Processing and will limit the Processing to what is strictly required.
  4. Conflicting Instructions. If Vendor reasonably believes a Company instruction infringes applicable Data Protection Laws, Vendor will promptly inform Company in writing and may suspend the relevant Processing until the Parties agree upon a lawful instruction.

CONFIDENTIALITY OBLIGATIONS.

• 1. Authorized Personnel. Vendor will ensure that any person authorized to Process Company Personal Data:
     1. is bound by written confidentiality obligations no less protective than those in this Addendum (or is subject to statutory/professional confidentiality duties); and
     2. Processes Personal Data only as necessary for the Services and in accordance with Company’s instructions.
  2. Access Controls and Reliability. Vendor will take reasonable steps to: (a) assess the reliability of personnel with access to Company Personal Data; and (b) ensure that access is limited to personnel who have a demonstrated need to access such data in connection with the Services.
  3. Training. Vendor will provide appropriate privacy and security training to personnel who Process Company Personal Data, proportionate to their role and the associated risks.

SECURITY MEASURES.

• 1. Security Program. Vendor will implement and maintain appropriate technical and organizational measures (“TOMs”) designed to protect Company Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. The TOMs will be appropriate to the risks presented by Processing, taking into account the state of the art, implementation costs, the nature, scope, context and purposes of Processing, and the likelihood and severity of risks to individuals.
  2. Annex of TOMs. The minimum TOMs applicable to the Services are described in Appendix 2 (Security Measures / TOMs). Vendor may update TOMs from time to time provided that any update does not materially degrade overall level of security.

SUBPPROCESSING.

• 1. General Authorization. Company grants Vendor general authorization to appoint Subprocessors to Process Company Personal Data, subject to the requirements of this Section 7.
  2. Subprocessor List. Vendor will maintain and make available to Company an up-to-date list of Subprocessors engaged to Process Company Personal Data. The current list is set out in Appendix 3, and may be updated in accordance with this Section 7.
  3. New Subprocessors. Vendor will provide Company with at least thirty (30) days’ advance written notice before engaging a new Subprocessor that will materially Process Company Personal Data or materially changing an existing Subprocessor’s scope. If Company objects on reasonable and documented data-protection grounds within fourteen (14) days, the Parties will cooperate in good faith to resolve the objection. Vendor may first seek to provide a commercially reasonable alternative that avoids use of the objected-to Subprocessor. If no reasonable alternative is available and continued use would prevent Company from complying with Data Protection Laws, the Parties will address the affected functionality in accordance with the termination and refund provisions of the Principal Agreement
  4. Subprocessor Contract Requirements. Vendor will enter into a written agreement with each Subprocessor that imposes materially equivalent data protection obligations as provided under this Addendum.
  5. Vendor Liability for Subprocessors. Vendor remains liable to Company for the acts and omissions of its Subprocessors relating to Processing of Company Personal Data to the same extent as if Vendor had performed the Processing directly, subject to the liability provisions of the Principal Agreement as applied by Section 14 of this Addendum.

DATA SUBJECT REQUESTS.

• 1. Vendor Assistance. Vendor will provide Company with commercially reasonable technical and organizational assistance to enable Company to respond to Data Subject requests (including requests to access, rectify, erase, restrict Processing of, or receive a portable copy of, Personal Data), taking into account the nature of the Processing and the information available to Vendor.
  2. Direct Requests. Vendor will not respond directly to any Data Subject exercising rights under Data Protection Laws, except: (a) on Company's documented instructions; or (b) as required by Applicable Laws, in which case Vendor will notify Company of the request as soon as reasonably practicable (to the extent permitted by law).
  3. Costs. Vendor may charge Company its reasonable costs incurred in providing assistance under Section 8.1, where the volume or complexity of requests exceeds what is reasonably necessary for Vendor to provide the Services

PERSONAL DATA BREACH.

• 1. Notification Timeline. Vendor will notify Company without undue delay after becoming aware of a Personal Data Breach affecting Company Personal Data and, where reasonably practicable, within forty-eight (48) hours of such awareness. The initial notification may be made without complete information and will be supplemented as further information becomes available
  2. Notification Content. Vendor's notification will, to the extent available, include:
     1. a description of the nature of the Personal Data Breach, including (where possible) the categories and approximate number of Data Subjects and records affected;
     2. the name and contact details of Vendor's data protection contact or other point of contact;
     3. a description of the likely consequences of the Personal Data Breach; and
     4. a description of the measures taken or proposed to address the breach, including measures to mitigate its possible adverse effects
  3. Vendor Cooperation. Vendor will cooperate with Company and take commercially reasonable steps, as directed by Company, to assist in the investigation, mitigation, and remediation of any Personal Data Breach, including facilitating notifications to Supervisory Authorities or Data Subjects where required by Data Protection Laws.
  4. Vendor Initiated Notifications. Vendor will not make or authorize any public disclosure or notification to a Supervisory Authority or Data Subject regarding a Personal Data Breach that involves Company Personal Data without Company's prior written approval, except where required to do so by Applicable Law

AUDIT AND COMPLIANCE.

• 1. Compliance Information. Upon Company's written request (no more than once per calendar year, absent reasonable cause), Vendor will make available to Company, within a reasonable period, information reasonably necessary to demonstrate Vendor's compliance with this Addendum, which may include one or more of the following (as determined by Vendor, acting reasonably):
     1. a current third-party audit report (e.g., SOC 2 Type II, ISO 27001 certificate, or equivalent), summary, or bridge letter;
     2. completed responses to reasonable security and data protection questionnaires; and/or
     3. written attestations regarding Vendor's compliance with specific provisions of this Addendum.
  2. Audit Right. Where the information provided under Section 10.1 is insufficient to demonstrate compliance with this Addendum, and where required by applicable Data Protection Laws, Company (or its appointed independent auditor, subject to reasonable confidentiality obligations) may, on at least thirty (30) days' prior written notice, conduct an audit of Vendor's data processing practices relevant to Company Personal Data. Any such audit will: (a) be conducted during normal business hours; (b) not unreasonably disrupt Vendor's operations; (c) occur no more than once per calendar year unless a Personal Data Breach has occurred; and (d) be conducted at Company's cost. Vendor may satisfy this obligation by providing access to its most recent third-party audit and remediation plans.

INTERNATIONAL TRANSFERS (RESTRICTED TRANSFERS)

• 1. Transfer Mechanisms (Order of Application). If a Restricted Transfer occurs, the Parties agree the following mechanisms will apply in order of precedence, to the extent applicable:
     1. an adequacy decision applicable to the transfer;
     2. EU SCCs (Decision 2021/914) for transfers subject to GDPR;
     3. for transfers subject to UK GDPR: either (i) the UK Addendum to the EU SCCs, or (ii) the IDTA, as specified in Appendix 5;
     4. any other valid transfer mechanism recognized under Data Protection Laws.
  2. EU SCCs Incorporation and Modules. The EU SCCs are incorporated by reference and form part of this Addendum for any Restricted Transfer subject to the GDPR, with the following parameters:
     1. Module: Module Two (Controller-to-Processor) applies where Company is a Controller, and Module Three (Processor-to-Processor) applies where Company is a Processor acting on behalf of another Controller.
     2. Clause 7 (Docking Clause): applies to permit Affiliates to accede as additional data exporters, subject to execution formalities.
     3. Clause 9 (Sub-Processors): Option 2 (general written authorization) applies, with the notice period specified in Section 7.3 of this Addendum.
     4. Clause 11 (Redress): the optional language enabling Data Subjects to lodge complaints with an independent dispute resolution body does not apply, unless Vendor elects otherwise in writing.
     5. Clause 13 (Supervision): the competent Supervisory Authority is identified in Annex I(C) of Appendix 4.
     6. Clause 17 (Governing Law): the law of the Republic of Ireland will govern the EU SCCs, unless another eligible EU Member State law is specified in the applicable Order Form or SCC annex.
     7. Clause 18 (Choice of Forum): disputes under the EU SCCs will be submitted to the courts of the Republic of Ireland, unless another eligible forum is specified in the applicable Order Form or SCC annex.
  3. UK Transfers (UK Addendum or IDTA). For Restricted Transfers subject to UK GDPR, the Parties will implement either the UK Addendum or the IDTA as specified in Appendix 5. If Appendix 5 does not specify, the Parties agree the UK Addendum will apply by default.
  4. Other Transfers. For transfers of Company Personal Data to or from jurisdictions not addressed above (including transfers subject to India's Digital Personal Data Protection Act 2023 or other applicable laws), the Parties will cooperate in good faith to implement an appropriate transfer mechanism as required by law.

RETURN AND DELETION OF PERSONAL DATA.

• 1. Company Election. Upon termination or expiration of the Services involving Company Personal Data, Vendor will, at Company’s election and subject to Section 12.3, return a copy of Company Personal Data in a commercially reasonable format and/or securely delete Company Personal Data from Vendor-controlled systems. During an active Subscription Term, Vendor will support deletion or return requests to the extent required by Data Protection Laws, reasonably necessary to respond to a Data Subject request, or supported by the applicable Platform functionality.
  2. Timing. Timing. Unless otherwise stated in the Principal Agreement or Appendix 1, Vendor will complete termination-related return and/or deletion within thirty (30) days after termination or expiration of the relevant Services, subject to backup cycles and the exceptions in Section 12.3.
  3. Deletion Exceptions. Vendor may retain Company Personal Data beyond the period in Section 12.2 only to the extent, and for the duration, required by Applicable Laws. Vendor will: (a) continue to protect retained data in accordance with this Addendum; (b) Process retained data solely for the legally required purpose(s); and (c) promptly delete such data once the legal retention obligation expires.

GENERAL PROVISIONS.

• 1. Order of Precedence. In the event of conflict: this Addendum prevails over the Principal Agreement solely with respect to the Processing of Personal Data; the EU SCCs prevail over this Addendum to the extent required to comply with GDPR; and the UK Addendum/IDTA prevails over this Addendum to the extent required to comply with UK GDPR.
  2. Severability. If any provision of this Addendum is held invalid or unenforceable, the remaining provisions continue in full force and effect.
  3. No Waiver. Failure by either Party to enforce any provision of this Addendum will not constitute a waiver of that Party's right to enforce such provision in the future.
  4. Governing Law. This Addendum is governed by the law governing the Principal Agreement, save that the EU SCCs and UK Addendum/IDTA are governed by the laws specified in those instruments.
  5. Updates and Amendment. This Addendum may be updated in accordance with the modification provisions of the Principal Agreement. Vendor will not materially reduce the data-protection protections applicable to Company Personal Data during a current Subscription Term, except to the extent required by Data Protection Laws, an applicable transfer mechanism, or reasonably necessary to address a material security or regulatory risk. Customer-specific negotiated amendments must be agreed in writing by the Parties.
  6. Entire Agreement. This Addendum (together with the Principal Agreement and the Appendices hereto) constitutes the entire agreement between the Parties with respect to the Processing of Company Personal Data and supersedes all prior agreements, representations, and understandings on the same subject matter.

Executed by duly authorized representatives as of the Effective Date.

APPENDIX 1 — DETAILS OF PROCESSING

1. Subject Matter

Processing of Personal Data for the purpose of providing and supporting the Joveo Agentic Suite and related Services selected or enabled by Company under the Principal Agreement. .

2. Duration

Processing will continue for the applicable Subscription Term and any period required for return or deletion in accordance with this Addendum.

3. Nature and Purpose of Processing; Categories of Data Subjects and Personal Data

The nature and purposes of Processing, categories of Data Subjects, and categories of Personal Data applicable to the Joveo Agentic Suite are described in Annex 1-A (Processing Activities / Record of Processing Activities) attached to this Appendix 1 and incorporated herein.

Only those Processing activities relating to the Services, offerings, features or functionality actually used by or made available to Company under the Principal Agreement apply to Company.

4. Special Category Data

AThe standard Services are not intended to require Special Category Data. However, configurable application or screening workflows may permit Company to collect sensitive or special-category fields. Any such Processing must be expressly supported by the applicable functionality and carried out on Company’s documented instructions in compliance with Section 3.4.

5. Frequency of Transfer / Processing

Continuous or event-based during the Subscription Term, depending on the functionality used. Certain advertising and analytics Processing may use aggregated or pseudonymous data; candidate interactions, applications, interviews, messaging and scheduling are processed when initiated or configured by Company or a Data Subject.

6. AI / Automated Processing Context

Certain Services may generate recommendations, scores, summaries or other AI-assisted outputs for Company review. Based on the currently assessed product configuration, final employment decisions remain with Company, and the AI Interviewer does not perform biometric identification, facial recognition, voice identification or emotion-recognition analysis.

Annex 1-A — Joveo Agentic Suite Record of Processing Activities

APPENDIX 2 — SECURITY MEASURES (TECHNICAL AND ORGANIZATIONAL MEASURES)

1. Access control to premises and facilities. Technical and organisational measures to control access to premises and facilities, particularly to check authorization:

• Security perimeters are defined and used to protect areas that contain either sensitive or critical information and information processing facilities.
• Physical security for offices, rooms and facilities are designed and applied.
• Physical protection against natural disasters, malicious attack or accidents are designed and applied.
• Equipment must be protected from power failures and other disruptions caused by failures in supporting utilities.
• For the purposes of secure disposal or reuse, equipment containing storage media that may possibly contain Personal Data are treated as though it does.
• Mobile equipment has appropriate protections (encryption).
• A clear desk policy for papers and removable storage media and a clear screen policy for information processing facilities is adopted.
• Equipment is sited and protected to reduce the risks from environmental threats and hazards, and opportunities for unauthorised access.
• It is ensured that only authorised persons can access premises and company buildings where customers' data is stored or processed.

1. Access control to systems. Technical (ID/password security) and organisational (user master data) measures for user identification and authentication:

• An access control policy is established, documented, and reviewed based on business and information security requirements.
• Users are provided with access to the network and network services that they have been specifically authorised to use.
• The allocation and use of privileged access rights is restricted and controlled.
• A formal user access provisioning process is implemented to assign or revoke access rights for all user types to all systems and services.
• The allocation of secret authentication information is controlled through a formal management process.
• Temporary passwords are given to users in a secure manner. The use of third parties or unprotected (clear text) electronic mail messages must be avoided.
• Password policy is known and implemented by every employee of Joveo.
• Password management system ensures quality passwords.
• The Local Administrator and other privileged accounts passwords never appear unscrambled on the network.
• Inactive sessions are shut down after a defined period of inactivity.
• Access to Information and application system functions by users and support personnel are restricted in accordance with the defined access control policy.
• Access to source code is protected and restricted to a level commensurate with the level of risk.

1. Access control to data. Requirements-driven definition of the authorization scheme and access rights, and monitoring and logging of accesses:

• An access control policy to customerʼs data is established, documented, and reviewed based on business and information security requirements.
• Joveo implemented a comprehensive encryption solution for data in transit (incl.Network).
• Database storages are encrypted.
• Operating Systems are hardened to enforce required security controls.
• Joveo ensures that procedures are established which guarantee correctness, integrity, and availability of Joveo data throughout all stages of data processing.
• Media are disposed of securely when no longer required, using formal procedures.

1. Disclosure control. Measures to transport, transmit and communicate or store data on data media (manual or electronic) and for subsequent checking:

• Access to systems that keep or process customerʼs data is allowed via secured network connections.
• Logging facilities and log information is protected against tampering and unauthorised access.
• When Information is sent or received, it is checked for the infection by viruses and if
• necessary, bear details of the authenticator and / or the integrity check (Digital signature).

1. Input control. Measures for subsequent checking whether data have been entered, changed, or removed (deleted), and by whom:

• Security related application events are logged on application level.
• Log entries identify the individual whose action is being audited, the individual affected by the action and the time of the action.
• The log policy regulates that the log entries shall not contain any sensitive information.

1. Job Control. Measures (technical/organisational) to segregate the responsibilities between Joveo (as processor) and Customer/Partner (as data controller):

• Unambiguous wording of the Addendum between Joveo and Customer with clear specifications of Joveo’s and Customerʼs obligations.
• Careful selection of Joveo as processor by Customer.
• Monitoring of the performance of the Addendum on a regular basis by Joveo and Customer.

1. Availability control. Measures to assure data security (physical/logical):

• Joveo developed a disaster recovery plan, which contains all the procedures and support Information required for business resumption.
• Joveo’s procedures are established which guarantee correctness, integrity, and availability of Joveo data throughout all stages of data processing.
• Access to backups is restricted to authorised personnel only.
• Backups are encrypted.
• Files that are uploaded to the platform are scanned against viruses.

1. Segregation control. Measures to provide for separate processing (storage, amendment, deletion, transmission) of data for different purposes:

• The environments used for development, testing and production purposes are physically separated.
• Usage of production un-anonymized data on development environment is not allowed.

APPENDIX 3 — SUBPROCESSOR LIST

APPENDIX 4 — EU SCCs (DECISION 2021/914) — ANNEX I, II, III (COMPLETION)

Annex I(A) — List of Parties

Data exporter(s):

Name: [COMPANY / COMPANY AFFILIATE NAME]

Address: [ADDRESS]

Contact person: [NAME, TITLE, EMAIL]

Role: [CONTROLLER OR PROCESSOR, AS APPLICABLE]

Activities relevant to the transfer: Receiving the Services and related Processing described in Appendix 1.

Data importer(s):

Name: Joveo, Inc.

Address: 101, Jefferson Drive, First Floor, Menlo Park, CA - 94025

Contact person: Prateek Mishra, CTO, prateek@joveo.com

Role: [PROCESSOR OR SUB-PROCESSOR, AS APPLICABLE]

Activities relevant to the transfer: Providing the Services and related Processing described in Appendix 1.

Annex I(B) — Description of Transfer. This Annex I(B) is completed by reference to Appendix 1 of this Addendum.

Annex I(C) — Competent Supervisory Authority. Competent Supervisory Authority: [IDENTIFY BASED ON EXPORTER ESTABLISHMENT]

Annex II — Technical and Organizational Measures. Completed by reference to Appendix 2 (Security Measures / TOMs).

Annex III — List of Subprocessors (Module Two/Three). Completed by reference to Appendix 3 (Subprocessor List).

APPENDIX 5 — UK TRANSFER MECHANISM (UK ADDENDUM OR IDTA)

Part A — Selected UK mechanism: UK ADDENDUM TO EU SCCs

Table 1 — Parties

Exporter: [COMPANY / COMPANY AFFILIATE]

Importer: Joveo, Inc.

Table 2 — Selected SCCs, Modules, and Clauses

EU SCCs: Decision 2021/914 incorporated via Appendix 4.

Modules: MODULE 2 OR MODULE 3, AS APPLICABLE

Table 3 — Appendix Information

Annex I(A)-(C): Appendix 4

Annex II: Appendix 2

Annex III: Appendix 3

Table 4 — Ending this Addendum when the Approved Addendum Changes

Ending mechanism: The Parties will comply with the UK Addendum’s change control requirements and update transfer terms as needed to remain compliant.