Neotouch Data Processing Addendum (Article 28 of the GDPR)

SECTION I

Clause 1 - Purpose and scope

a) The purpose of these standard contractual clauses (hereinafter the ‘Clauses’) is to ensure compliance with Article 28, paragraphs 3 and 4, of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

b) The controllers and processors listed in Annex I have accepted these clauses in order to ensure compliance with Article 28(3) and (4) of Regulation (EU) 2016/679 and/or the provisions of Article 29(3) and (4) of Regulation (EU) 2018/1725.

c) These clauses apply to the processing of personal data as described in Annex II.

d) Annexes I to IV form an integral part of these clauses.

e) These clauses are without prejudice to the obligations to which the controller is subject under Regulation (EU) 2016/679 and/or Regulation (EU) 2018/1725.

f) These clauses alone are not sufficient to ensure compliance with the obligations relating to international transfers in accordance with Chapter V of Regulation (EU) 2016/679 and/or Regulation (EU) 2018/1725.

Clause 2 - Invariability of the Clauses

a) The Parties undertake not to amend the clauses, except in respect of the addition of information to the annexes or the updating of the information contained therein.

b) The Parties are not, however, prevented from including the standard contractual clauses set out in these clauses in a broader contract, nor from adding other clauses or additional safeguards, provided that these do not directly or indirectly contradict the clauses or infringe upon the fundamental rights and freedoms of the data subjects.

Clause 3 - Interpretation

a) Where terms defined in Regulation (EU) 2016/679 or in Regulation (EU) 2018/1725 appear in the clauses, they shall have the same meaning as in the relevant Regulation.

b) These clauses must be read and interpreted in the light of the provisions of Regulation (EU) 2016/679 and Regulation (EU) 2018/1725 respectively.

c) These clauses must not be interpreted in a manner contrary to the rights and obligations set out in Regulation (EU) 2016/679 / Regulation (EU) 2018/1725 or in a manner that infringes upon the fundamental rights or freedoms of data subjects.

Clause 4 - Hierarchy

In the event of any conflict between these Clauses and the provisions of any related agreements existing between the parties at the time these clauses are agreed or which are concluded subsequently, these clauses shall prevail.

Clause 5 - Annex

a) Any entity that is not a party to these clauses may, with the agreement of all Parties, accede to them at any time, either as a data controller or as a data processor, by completing the annexes and signing Annex I.

b) Once the annexes referred to in point (a) have been completed and signed, the acceding entity shall be deemed a party to these clauses and shall enjoy the rights and be subject to the obligations of a data controller or a data processor, in accordance with its designation in Annex I.

c) These clauses do not create any rights or obligations for the adhering party for the duration of the adherence period.

SECTION II - OBLIGATIONS OF THE PARTIES

Clause 6 - Description of the processing operation(s)

Details of the processing operations, including the categories of personal data and the purposes of the processing for which personal data are processed on behalf of the data controller, are set out in Annex II.

Clause 7 - Obligations of the parties

7.1 Instructions

a) The processor shall process personal data only on documented instructions from the controller, unless required to do so by Union law or the law of the Member State to which the processor is subject. In such a case, the processor shall inform the controller of that legal obligation prior to processing, unless prohibited from doing so by law on important grounds of public interest. Further instructions may also be given by the controller at any time during the processing of personal data. Such instructions must always be documented.

b) The processor shall immediately inform the controller if, in its opinion, an instruction given by the controller constitutes a breach of Regulation (EU) 2016/679 / Regulation (EU) 2018/1725 or other provisions of Union law or the law of the Member States relating to data protection.

7.2 Purpose limitation

The processor shall process personal data only for the specific purpose(s) of the processing, as set out in Annex II, unless further instructions are given by the controller.

7.3 Duration of the processing of personal data

Processing by the processor shall take place only for the duration specified in Annex II.

7.4 Security of processing

a) The processor shall implement at least the technical and organisational measures specified in Annex III to ensure the security of personal data. These measures include the protection of data against any security breach leading, accidentally or unlawfully, to the destruction, loss, alteration, unauthorised disclosure of personal data or unauthorised access to such data (personal data breach). When assessing the appropriate level of security, the parties shall take due account of the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing, as well as the risks to data subjects.

b) The processor shall grant its staff access to the personal data being processed only to the extent strictly necessary for the performance, management and monitoring of the contract. The processor shall ensure that persons authorised to process personal data undertake to respect confidentiality or are subject to an appropriate legal obligation of confidentiality.

7.5 Sensitive data

The processing does not involve sensitive data within the meaning of the GDPR. As such, such data may not be subcontracted for the purposes agreed under the main contract initially concluded between the parties.

7.6 Documentation and compliance

a) The parties must be able to demonstrate compliance with these clauses.

b) The processor shall deal promptly and appropriately with requests from the controller regarding the processing of data in accordance with these clauses.

c) The processor shall make available to the controller all information necessary to demonstrate compliance with the obligations set out in these clauses and arising directly from Regulation (EU) 2016/679 and/or Regulation (EU) 2018/1725. At the request of the controller, the processor shall also allow and assist in audits of the processing activities covered by these clauses, at reasonable intervals or where there are indications of non-compliance. When deciding on an inspection or audit, the controller may take into account any relevant certifications held by the processor.

d) The data controller may decide to carry out the audit itself or to appoint an independent auditor. Audits may also include inspections at the data processor’s premises or physical facilities and shall, where appropriate, be carried out subject to reasonable notice. Audits may be carried out subject to a minimum notice period of 15 days. In the event of a conflict of interest with the third-party auditor, the processor may refuse the audit, provided that the refusal is justified in writing to the data controller. In such a case, the data controller may propose another third-party auditor or carry out the audit itself.

e) The parties shall make the information set out in this clause, including the results of any audit, available to the competent supervisory authority/authorities upon request.

7.7 Use of subprocessors

a) GENERAL WRITTEN AUTHORISATION: the processor has the data controller’s general authorisation to engage subprocessors from an agreed list. The processor shall specifically inform the controller in writing of any proposed changes to this list by adding or replacing subprocessors at least twenty-five (25) days in advance, thereby giving the controller sufficient time to object to such changes before the relevant subprocessor(s) are engaged. The processor shall provide the controller with the information necessary to enable the controller to exercise its right to object.

b) Where the processor engages a subprocessor to carry out specific processing activities (on behalf of the controller), it shall do so by means of a contract which imposes on the subprocessor, in substance, the same data protection obligations as those imposed on the processor under these clauses. The processor shall ensure that the subprocessor complies with the obligations to which the processor itself is subject under these clauses and Regulation (EU) 2016/679 and/or Regulation (EU) 2018/1725.

c) At the request of the controller, the processor shall provide the controller with a copy of this contract concluded with the subprocessor and of any subsequent amendments thereto. To the extent necessary to protect trade secrets or other confidential information, including data processing (Article 28 of the GDPR) personal data, the processor may redact the text of the contract before distributing a copy.

d) The processor remains fully liable to the controller for the performance of the subprocessor’s obligations in accordance with the contract concluded with the subprocessor. The processor shall inform the controller of any breach by the subprocessor of its contractual obligations.

7.8 International transfers

a) Any transfer of data to a third country or an international organisation by the processor shall be carried out only on the basis of documented instructions from the controller or in order to comply with a specific requirement of Union law or the law of the Member State to which the processor is subject, and shall be carried out in accordance with Chapter V of Regulation (EU) 2016/679 or Regulation (EU) 2018/1725.

b) The controller agrees that where the processor engages a subprocessor in accordance with clause 7.7 to carry out specific processing activities (on behalf of the controller) and those processing activities involve a transfer of personal data within the meaning of Chapter V of Regulation (EU) 2016/679, the processor and the subprocessor may ensure compliance with Chapter V of Regulation (EU) 2016/679 by using the standard contractual clauses adopted by the Commission on the basis of Article 46(2) of Regulation (EU) 2016/679, provided that the conditions for the use of those standard contractual clauses are met.

Clause 8 - Assistance to the controller

a) The processor shall inform the controller without delay of any request it has received from the data subject. It shall not act on that request itself, unless authorised to do so by the controller.

b) The processor shall assist the controller in fulfilling its obligation to respond to requests from data subjects to exercise their rights, taking into account the nature of the processing. In carrying out its obligations under points (a) and (b), the processor shall comply with the controller’s instructions.

c) In addition to the processor’s obligation to assist the controller under Clause 8(b), the processor shall also assist the controller in ensuring compliance with the following obligations, taking into account the nature of the processing and the information available to the processor:

1. the obligation to carry out an assessment of the impact of the envisaged processing operations on the protection of personal data (‘data protection impact assessment’) where a type of processing is likely to result in a high risk to the rights and freedoms of natural persons;

2. the obligation to consult the competent supervisory authority/authorities prior to processing where a data protection impact assessment indicates that the processing would result in a high risk unless the controller takes measures to mitigate the risk;

3. the obligation to ensure that personal data is accurate and up to date, by informing the controller without delay if the processor becomes aware that the personal data it processes is inaccurate or has become out of date;

d) the obligations set out in Article 32 of Regulation (EU) 2016/679. The parties shall set out in Annex III the appropriate technical and organisational measures by which the processor is required to assist the controller in the application of this clause, as well as the scope and extent of the assistance required.

Clause 9 - Notification of personal data breaches

In the event of a personal data breach, the processor shall cooperate with the controller and assist the controller in complying with its obligations under Articles 33 and 34 of Regulation (EU) 2016/679 or Articles 34 and 35 of Regulation (EU) 2018/1725, whichever is applicable, taking into account the nature of the processing and the information available to the processor.

9.1 Data breach relating to data processed by the controller

In the event of a personal data breach relating to data processed by the controller, the processor shall assist the controller:

a) for the purposes of notifying the personal data breach to the competent supervisory authority/competent supervisory authorities as soon as possible after the controller becomes aware of it, where applicable (unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons);

b) for the purpose of obtaining the following information which, in accordance with Article 33(3) of Regulation (EU) 2016/679, must be included in the data controller’s notification, and shall include, at a minimum:

1. the nature of the personal data, including, where possible, the categories and approximate number of data subjects affected by the breach and the categories and approximate number of personal data records concerned;

2. the likely consequences of the personal data breach;

3. the measures taken or proposed to be taken by the controller to address the personal data breach, including, where appropriate, measures to mitigate any adverse consequences.

Where, and to the extent that, it is not possible to provide all the information at the same time, the initial notification shall contain the information available at that time and, as further information becomes available, it shall be provided as soon as possible;

c) for the purposes of complying, in accordance with Article 34 of Regulation (EU) 2016/679, with the obligation to communicate the personal data breach to the data subject as soon as possible, where the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons.

9.2 Data breaches relating to data processed by the processor

In the event of a personal data breach relating to data processed by the processor, the processor shall notify the controller without undue delay after becoming aware of it. This notification shall contain at least:

a) a description of the nature of the breach (including, where possible, the categories and approximate number of data subjects affected by the breach and the personal data records concerned);

b) the contact details of a point of contact from whom further information may be obtained regarding the personal data breach;

c) its likely consequences and the measures taken or proposed to be taken to address the breach, including to mitigate any adverse consequences.

Where, and to the extent that, it is not possible to provide all the information at the same time, the initial notification shall contain the information available at that time and, as further information becomes available, it shall be provided as soon as possible.

The parties shall set out in Annex III all other information that the processor must provide when assisting the controller in fulfilling the latter’s obligations under Articles 33 and 34 of Regulation (EU) 2016/679.

SECTION III. FINAL PROVISIONS

Clause 10 - Breach of clauses and termination

a) Without prejudice to the provisions of Regulation (EU) 2016/679 and/or Regulation (EU) 2018/1725, in the event of a breach by the processor of its obligations under these clauses, the controller may instruct the processor to suspend the processing of personal data until the processor has complied with these clauses or until the contract is terminated. The processor shall promptly inform the controller if it is unable to comply with these clauses, for whatever reason.

b) The controller shall be entitled to terminate the contract insofar as it relates to the processing of personal data in accordance with these clauses if:

1. the processing of personal data by the processor has been suspended by the controller in accordance with point (a) and compliance with these clauses is not restored within a reasonable period and, in any event, within one month of the suspension;

2. the processor is in serious or persistent breach of these clauses or of its obligations under Regulation (EU) 2016/679 and/or Regulation (EU) 2018/1725;

3. The processor fails to comply with a binding decision of a competent court or the competent supervisory authority/competent supervisory authorities concerning its obligations under these clauses or Regulation (EU) 2016/679 and/or Regulation (EU) 2018/1725.

c) The processor shall be entitled to terminate the contract insofar as it relates to the processing of personal data under these clauses where, after informing the controller that its instructions breach the applicable legal requirements in accordance with clause 7.1(b), the controller insists that its instructions be followed.

d) Following termination of the contract, the processor shall, at the controller’s discretion, all personal data processed on behalf of the controller and certify to the controller that it has done so, or return all personal data to the controller and destroy existing copies, unless Union or national law requires them to be retained for a longer period. The processor shall continue to ensure compliance with these clauses until the data has been deleted or returned.

ANNEX I - List of parties

Data controller(s):

Name: Customer, as specified in the contract.

Name, role and contact details of the contact person for data protection matters: as specified in the contract.

Data processor:

Name: QUADIENT France

Represented by Stéphanie AUCHABIE, with full authority for the purposes hereof

Address: 7 Rue Henri Becquerel 92500 RUEIL-MALMAISON

Position and contact details of the contact person for data protection matters: Data Protection Officer (France), privacyteam@quadient.com.

ANNEX II - Description of the processing

Categories of data subjects whose personal data are processed:

• The Client’s employees who use the solution

• Recipients of mailings

• The Client’s customers

Categories of personal data processed:

Personal data relating to the Client: surname, first name, postal address, telephone/fax number, email address, job title where applicable, and any personal data contained in the documents processed;

Data relating to the Client’s authorised NEOTOUCH Users and Administrators: email address, work telephone number, surname, first name, profession, contact details and username of persons authorised to interact with the solution. This refers to the information transmitted by the platform when the Client creates user accounts;

Login details of the Client’s authorised NEOTOUCH Users and Administrators: username, IP address, date and time.

Nature of the processing: From the Neotouch platform, collection, organisation, archiving, consultation and distribution of the Client’s outsourced correspondence.

Purposes for which personal data is processed on behalf of the Data Controller:

• Forwarding of documents to recipients

• Archiving of documents for future reference

• Creation and management of user accounts

• Providing assistance to authorised users where necessary (support)

• Forwarding documents from the platform to the relevant parties

• Compliance with contractual obligations

• Post-event invoicing of Clients

• Maintenance / Patches

Duration of processing: duration of the contract.

ANNEX III - Technical and organisational measures, including those designed to ensure data security

Notwithstanding any additional measures agreed in the main contract, Quadient has implemented and will maintain the following security measures for the company’s and the client’s data (the “data”), which, together with the security commitments in this Data Processing Agreement (“DPA”) (including the provisions of the GDPR), constitute Quadient’s sole liability with regard to the security of such data.

ANNEX IV - List of Quadient France’s subprocessors

In the interests of transparency regarding information and communications, below is a list of Esker S.A.’s potential subsequent processors (Esker S.A. itself being a subsequent processor of QUADIENT France)