DATA PROCESSING AGREEMENT

1. Implement and maintain current and appropriate technical and organizational measures to protect Company Data against accidental, unauthorized or unlawful Processing and against accidental loss, destruction, damage, alteration, disclosure or access;

2. Provide third-party attestation of static or dynamic application security testing or penetration testing on all software Processing Company Data, remediate any identified high vulnerabilities prior to delivery to Company, provide written remediation plans for medium and low vulnerabilities, and provide evidence of its remediation of any identified security vulnerabilities at Company’ request;

3. Maintain a level of security appropriate to the harm that may result from any unauthorized or unlawful Processing or accidental loss, destruction, damage, denial of service, alteration or disclosure, and appropriate to the nature of Company Data;

4. Oblige its employees, agents or other persons to whom it provides access to Company Data to keep it confidential; take reasonable steps to ensure the integrity of any employees who have access to Company Data; provide annual training to staff and subcontractors on the security requirements contained herein;

5. Maintain measures designed to ensure the ongoing confidentiality, integrity, availability and resilience of Service Provider’s systems and services;

6. Maintain a process for regularly testing, assessing and evaluating the effectiveness of technical and organizational measures for ensuring the security of the Processing of Company Data, regularly testing such measures to validate their appropriateness and effectiveness, and implementing corrective action where deficiencies are revealed by such testing;

7. Log all individuals’ access to and activities on systems and at facilities containing Company Data. Upon Company’s request, and subject to applicable laws and the Service Providers retention policy, Service Provider will provide a report detailing a list of authorized users, their associated privileges, status of accounts, and history of activities;

8. For passwords applicable to Service Provider’s access, adhere to password policies for standard and privileged accounts consistent with industry best practices; protect both Service Providers and Company user accounts with access to Company Data using multi-factor authentication (e.g., using at least two different factors to authenticate such as a password and a security token or certificate);

9. Store and transmit Company Data using strong cryptography, consistent with industry best practices, and pseudonymize Personal Data where appropriate;

10. If connection is permitted by Company, only connect to Company’s networks via Virtual Private Network (VPN), without split tunneling, and utilizing strong cryptography consistent with industry best practices;

11. Ensure that only those Service Provider’s personnel who need to have access to Company Data are granted access, such access is limited to the least amount required, and only granted for the purposes of performing obligations under this DPA. Service Provider shall conduct access reviews upon each individual’s scope of responsibility change, Service Provider’s staffing change or other change impacting Service Provider’s personnel access to Company Data;

12. Maintain a physical security program that is consistent with industry best practices;

13. Ensure that any storage media (whether magnetic, optical, non-volatile solid state, paper, or otherwise capable of retaining information) that captures Company Data is securely erased or destroyed before repurposing or disposal;

14. Measures and assurances regarding US government surveillance (“Additional Safeguards”):

Apester agrees and hereby represents it maintains, and will continue to maintain, the following additional safeguards in connection with any Personal Data transferred under this Annex:

a) Apester maintains industry standard measures to protect the Personal Data from interception (including in transit from Customer to Apester and between different systems and services). This includes maintaining encryption of Personal Data in transit and at rest.

b) Apester will make reasonable efforts to resist, subject to applicable laws, any request for bulk surveillance relating to the Personal Data protected under the GDPR or the UK GDPR, including (if applicable) under section 702 of the United States Foreign Intelligence Surveillance Court (“FISA”).

c) If Apester becomes aware of any law enforcement agency or other governmental authority (“Authority”) attempt or demand to gain access to or a copy of the Personal Data (or part thereof), whether on a voluntary or a mandatory basis, then, unless legally prohibited or under a mandatory legal compulsion that requires otherwise, Apester shall: inform the relevant Authority that Apester is a Processor of the Personal Data and that Customer, as the Controller has not authorized Apester to disclose the Personal Data to the Authority; inform the relevant Authority that any and all requests or demands for access to the Personal Data should be directed to or served upon Customer in writing; and use reasonable legal mechanisms to challenge any such demand for access to Personal Data which is under the Apester’s control.

d) Notwithstanding the above, if, taking into account the nature, scope, context and purposes of the related Authority’s intended access to Personal Data, Apester has a reasonable and good-faith belief that urgent access is necessary to prevent an imminent risk of serious harm to any individual or entity, these subsections shall not apply. In such event, Apester shall notify Customer, as soon as possible, following the access by the Authority, and provide Customer with relevant details, unless and to the extent legally prohibited to do so.

Apester will inform Customer, upon written request (and not more than once a year), of the types of binding legal demands for Personal Data Apester has received and complied with, including demands under national security orders and directives, specifically including any process under Section 702 of FISA.