DATA PROTECTION ADDENDUM

Yieldmo, Inc., on behalf of itself and its Affiliates (“Yieldmo”) and the company identified in the Main Agreement (“Company”) have entered or intend to enter into an agreement, insertion order or other contract, as amended from time to time, for the provision or receipt of services (the “Main Agreement”). This Data Protection Addendum (‘DPA”) is effective as of the effective date of the Main Agreement (“Effective Date”) and is intended to comply with the parties’ obligations under Data Privacy Laws with respect to the Processing of Personal Data pursuant to this DPA and the Main Agreement. Yieldmo and Company are Individually referred to as a “Party” or together as “Parties”. In the event of a conflict between this DPA and the Main Agreement, this DPA shall prevail.

1. DEFINITIONS.

a. “Affiliate” means, with respect to a Party, an entity that owns or controls, is owned or controlled by or is or under common control or ownership with the Party, where “control” is defined as the possession, directly or indirectly, of the power to direct or cause the direction of the management and policies of an entity, whether through ownership of voting securities, by contract or otherwise.

b. “Business” or “Controller” shall mean an entity that determines the purposes and means of Processing of Personal Information.

c. “Controller Personal Data” means any Personal Data that is provided or made available by a Party (“Provider”) to the other Party (“Recipient”) under this DPA or under the Main Agreement in connection with the Provider’s provision or use (as applicable) of the Controller Services.

d. “Controller Services” means the services provided by a Party to the other Party as described in Exhibit A under “Controller Services”, and as may be further described in the Main Agreement.

e. “Data Privacy Laws” shall mean: (i) applicable laws and regulations in the United States relating to data protection and privacy, including without limitation the California Consumer Privacy Act of 2018 (“CCPA“) as amended by the California Privacy Rights Act (the “CPRA”), the Virginia Consumer Data Protection Act (the “VCDPA”), the Colorado Privacy Act (the “CPA”), the Connecticut Data Protection Act (the “CTDPA”), and/or the Utah Consumer Privacy Act (the “UCPA”); in each case, all of the foregoing as and when applicable and as amended, replaced or supplemented from time to time, and all subordinate legislation made under them, together with any codes of practice, regulations or other guidance issued by the governments, agencies, data protection regulators, or other authorities in the relevant countries or jurisdictions.

f. “Data Subject” or “Consumer” means a natural person to whom any Personal Data pertains.

g. “IAB Privacy Frameworks” means the Interactive Advertising Bureau (IAB)’s signals and contractual frameworks, rules and guidelines for processing Personal Data as follows: (a) for Consumers in the US, the IAB Global Privacy Platform (“GPP“) and the corresponding IAB Multi-State Privacy Agreement (“MSPA“), as each of the foregoing may be modified by IAB from time to time, and any successors to the foregoing.

h. “Notice and Choice Mechanisms” means (i) for Consumers in the US or Canada but excluding California, a clear and conspicuous method that enables the Consumer to opt-out of the Sale of Personal Information and to opt-out of the Processing of Personal Information for the purpose of targeted advertising, and (ii) for Consumers in California, a clear and conspicuous “Do Not Sell or Share My Personal Information” link or alternate opt-out link that enables the Consumer to opt-out of both Sales and Sharing of their Personal Information.

i. “Process, Processing and Processed” means any operation or set of operations which is performed on Personal Data or on subsets thereof, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

j. “Permitted Purposes” shall have the meaning assigned to it Section 3(c) below.

k. “Personal Data” or the equivalent ‘personal information’ means any information relating, directly or indirectly, to an identified or identifiable natural person or otherwise as defined in applicable Data Privacy Laws.

l. “Personal Data Breach” means unauthorized, accidental or unlawful Processing, access, loss, or disclosure of Personal Data.

m. “Personnel” means all officers, directors and employees, contractors or service providers of a Party or its Affiliates.

n. “Processor Personal Data” means: (i) any hashed emails (“HEMs”) and/or other Personal Data that Company derives independently and provides to Yieldmo solely in connection with the Processor Services, as specified in Exhibit A hereto under “Processor Services”; and (ii) Personal Data contained in Restricted Impressions as described in Section 3(e) below.

o. “Processor Services” means specific services provided by Yieldmo to Company for which Yieldmo acts as a Service Provider/Processor on behalf of Company, as described in Exhibit A under “Processor Services”.

p. “Service Provider” or “Processor” shall mean an entity that Processes Personal Information on behalf of a Business or Controller.

q. “Sell”, “Selling”, “Share”, “Sharing”, “Sensitive Information” and “Sensitive Personal Information” and “Third Party” shall have the meanings assigned to them under Data Privacy Laws.

2. Role of the Parties.

a. Controller Personal Data. Each Party is an independent Controller of the Controller Personal Data. Each Party shall be individually and separately responsible for complying with the obligations that apply to it as a Controller under Data Privacy Law. The Parties agree that they are not joint Controllers of any Controller Personal Data. Each Party will individually determine the purposes and means of its Processing of Controller Personal Data. For purposes of the CCPA and CPRA, each Party is considered to be a “Third Party”.

b. Processor Personal Data. Notwithstanding the foregoing, with respect to Processor Personal Data, the Party that provides or makes available such data acts as Controller / Business and the Party that receives it acts as Processor / Service Provider, as further determined under Section 3(e) and as set out in Exhibit A. For clarity, with respect to the HEMs and other Personal Data described in clause (i) of the definition of “Processor Personal Data,” Yieldmo acts as Processor; and with respect to Restricted Impressions under Section 3(e), the receiving Party acts as Processor.

3. Obligations of the Parties.

a. Compliance with Data Privacy Laws and SRPs. Each Party shall comply with all applicable requirements of Data Privacy Laws. Each Party represents and warrants at all times that: (i) it has the necessary right and authority to enter into this DPA and to perform its obligations herein; (ii) its execution and performance under this DPA and the Main Agreement will not violate any agreement to which it is a party; (iii) it has provided all required information to Data Subjects including, where required, that Personal Data that may be passed to third parties for the purposes of the Processing under this DPA and the Main Agreement; and (iv) in collecting Controller Personal Data, it did not violate any applicable self-regulatory principles promulgated by the Network Advertising Initiative (“NAI”) or the Digital Advertising Alliance (“DAA”) (such Self-Regulatory Principles, collectively, the “SRPs”). Without limiting the foregoing, each Party will maintain a publicly-accessible privacy policy on its website that is in compliance with Data Privacy Laws.

b. Notification. Each Party will notify the other Party in writing of any action or instruction of the other Party under this DPA or the Main Agreement which, in its opinion, infringes applicable Data Privacy Laws.

c. Permitted Purposes. Subject to this DPA, each Party, acting as a Controller, may Process the Controller Personal Data in accordance with, and for the purposes permitted in, the Main Agreement and listed in Exhibit A hereto (the “Permitted Purposes”).

d. U.S. State Privacy Law Compliance. Provider will have the right to: (i) take reasonable and appropriate steps to help ensure that Recipient uses the Controller Personal Data in a manner consistent with Provider’s obligations under and as required by Data Privacy Laws, and (ii) upon reasonable prior written notice, to take reasonable and appropriate steps to stop and remediate unauthorized use of such Controller Personal Data under and as required by applicable Data Privacy Laws. Recipient will notify Provider if Recipient determines that it can no longer meet its obligations under applicable Data Privacy Laws. Recipient acknowledges and agrees that it is receiving Controller Personal Data only for the Permitted Purposes. Recipient shall provide not less than the same level of privacy protection as is required by Data Privacy Laws for such Controller Personal Data.

e. Notice and Choice Signal Compliance. Where Provider uses or provides Controller Services in connection with Personal Data for which a Data Subject has signaled to Provider or its upstream partner(s) that such Data Subject exercised their rights under an applicable Notice and Choice Mechanism (the “Restricted Impressions”), Provider shall communicate the appropriate signal to Recipient in the applicable ad requests and/or bid requests sent by Provider to Recipient through the Controller Services. In such cases, the Provider is considered to be the “Business” or “Controller” and Recipient is considered to be a “Service Provider” or “Processor” (or if applicable, Provider is a “Service Provider” or Processor” and Recipient is a “sub-service provider” or “Subprocessor”), and the Personal Data contained within the Restricted Impressions shall be deemed “Processor Personal Data”.

f. Territory. Neither party shall provide or make available any Personal Data to the other Party concerning data subjects that reside outside of the United States.

4. Data Processor Obligations.

With respect to Processor Personal Data, Recipient and its Personnel shall do the following:

a. Purpose Limitation. Process the Processor Personal Data only to the extent, and in such a manner, as is necessary for the provision of its services to Provider and in accordance with this DPA, the Main Agreement and/or Provider’s written instructions from time to time and not for any other purpose. Recipient shall ensure that any of its Personnel who has access to Processor Personal Data does not Process it except in compliance with the foregoing. Recipient shall promptly inform Provider if, in its opinion, an instruction from Provider infringes Data Privacy Laws.

b. Personnel. Ensure that all Personnel authorized by it to Process the Processor Personal Data are bound by enforceable confidentiality obligations not to disclose it or use it in any manner other than as permitted herein. Recipient shall use commercially reasonable efforts consistent with accepted measures in Recipient’s industry to ensure the reliability of Personnel who have access to Processor Personal Data. Recipient shall ensure that access to the Processor Personal Data is limited to: (1) Personnel who need access for the purpose of exercising Recipient’s rights or performing Recipient’s obligations under this DPA and the Main Agreement; and (2) in the case of access by any Personnel, only such part or parts of the Processor Personal Data as is strictly necessary for performance of such Personnel’s duties. Recipient shall ensure that Personnel: (i) are informed of and maintain the confidential nature of the Processor Personal Data; (ii) have undertaken training in the Data Privacy Laws relating to handling of Personal Data; and (iii) are aware of Recipient’s duties and obligations under the Data Privacy Laws and this Agreement. Recipient shall remain liable to Provider for the acts and omissions of all of Recipient’s Personnel.

c. Information and Compliance. Upon Provider’s reasonable request, Recipient will make available all information Recipient’s possession or control as is reasonably necessary for Provider to conduct and document data protection assessments in accordance with Data Privacy Laws. Provider will have the right to: (i) take reasonable and appropriate steps to help ensure that Recipient uses Processor Personal Data in a manner consistent with Recipient’s obligations under and as required by Data Privacy Laws; and (ii) take reasonable and appropriate steps to stop and remediate unauthorized use of such Processor Personal Data under and as required by applicable Data Privacy Laws. Recipient will notify Provider in writing within five (5) business days if it determines that it can no longer meet its obligations under applicable Data Privacy Laws.

d. No Data “Selling” or “Sharing”. Recipient acknowledges and confirms that it does not receive any Processor Personal Data as consideration for any Processor Services. Recipient is prohibited from: (i) Selling or Sharing Processor Personal Data or otherwise making Processor Personal Data available to any third party for monetary or other valuable consideration; (ii) retaining, using, or disclosing Processor Personal Data for any purpose other than for performing the Processor Services; (iii) retaining, using, or disclosing Processor Personal Data outside of the direct business relationship between the parties hereto; or (iv) combining Processor Personal Data with other information that Recipient receives from or on behalf of another person or persons, or collects from its own interaction with the Consumer. Recipient represents and warrants that it understands the rules, restrictions, requirements and definitions of the Data Privacy Laws and agrees to refrain from taking any action that would cause any transfers of Processor Personal Data to or from Recipient, or to or from any of Recipient’s Personnel or Subprocessors, to qualify as “Selling” or “Sharing” any Personal Data under any Data Privacy Laws. Notwithstanding subsection (iv) above, the parties acknowledge that where the services to be provided by Provider to Recipient consist of identity resolution, measurement, and attribution, such services may require Recipient to map cookie identifiers supplied by Provider against Recipient’s own identity resolution infrastructure. Such mapping, performed solely to deliver the Processor Services and produce outputs returned to Provider, does not constitute “combining” within the meaning of subsection (iv).

e. Subprocessors. Provider provides general authorization for Recipient to engage Subprocessors. Recipient’s Subprocessors in effect as of the Effective Date, located at https://yieldmo.com/processor-list/, are deemed approved. Recipient will provide Provider with at least fourteen (14) days’ prior written notice before engaging any new Subprocessor, during which Provider may object on reasonable, documented data-protection grounds. If the Parties cannot resolve a timely objection in good faith, Provider’s sole remedy is to suspend or terminate the affected Processor Services. Recipient shall ensure that its Subprocessors are bound to substantially the same data protection obligations as set out in this Agreement and that its contract with the Subprocessors provides sufficient guarantees to meet the requirements of this Agreement and Data Privacy Laws. Recipient shall be responsible and liable for the Subprocessor’s acts and omissions with respect to the Personal Data to the same extent as if such acts and omissions had been committed by Recipient.

f. Compliance Cooperation. In the event that Recipient receives a request from a Consumer relating to Processor Personal Data, to confirm whether their Personal Data is being Processed, to access their Personal Data, to correct inaccuracies in their Personal Data, to delete their Personal Data, to obtain a copy of their Personal Data, or to opt-out of the Processing of their Personal Data for the purposes of targeted advertising, sale or profiling, Recipient shall forward the request to Provider in writing within five (5) business days of the receipt of such request and shall provide reasonable assistance and cooperation to Provider to comply with the request in accordance with Data Privacy Laws. Further, Recipient shall, taking into account the nature of the Processing, reasonably assist Provider (insofar as possible) in (i) ensuring compliance with Provider’s obligations under Data Privacy Laws in respect of security of Processing, notification of Personal Data Breaches, data protection impact assessments and prior consultation with supervisory authorities; (ii) enabling Provider to: (1) conduct a defense of any claim or allegation of unauthorized use, Processing, disclosure or acquisition of or access to any Processor Personal Data, and (2) investigate, prevent, mitigate or rectify any Personal Data Breach, breach of Privacy Laws, or breach of this Agreement. No more than once in any twelve (12)-month period (or more frequently if required following a Personal Data Breach affecting Provider’s Personal Data or upon the documented demand of a supervisory authority), and on at least thirty (30) days’ prior written notice, Recipient shall make available the information reasonably necessary to demonstrate compliance with this Section and, where such information is insufficient, allow for and contribute to an audit conducted by Provider or an independent auditor mandated by Provider and reasonably acceptable to Recipient. Any such audit shall take place during normal business hours, be subject to Recipient’s confidentiality and security policies, and be conducted so as not to unreasonably disrupt Recipient’s operations, in each case at Provider’s expense. Recipient may respond to an audit request by providing relevant written security documentation, completed security questionnaires, and a written summary of the technical and organizational measures set out in Exhibit B.

g. Data Deletion. Recipient shall delete Processor Personal Data or portions thereof upon Provider’s request. Recipient shall upon termination or expiry of the Main Agreement or completion of the relevant services delete and destroy all Processor Personal Data processed thereunder (including any copies of it) and upon request provide evidence of their destruction to Provider, unless applicable Data Privacy Laws requires the continued storage of Processor Personal Data; provided, further, that Recipient may retain copies of Processor Personal Data contained in routine, secure backups created in the ordinary course of business, which copies shall be deleted in accordance with its standard backup-retention cycle and shall remain subject to the protections of this DPA until deleted. The obligations in this Agreement will remain in effect until deletion of all Processor Personal Data by Recipient.

h. Experian as Subprocessor. In the event that Provider makes available to Recipient any Personal Data with respect to which Provider instructs Recipient to make available such data to Experian acting as Subprocessor, then Provider represents and warrants that such Personal Data will not include any data about individuals who reside outside the United States of America.

5. Provider’s Obligations for Processor Personal Data

. Where Provider makes available HEMs and/or other Processor Personal Data to Recipient for the Processor Services, Provider represents and warrants that, with respect to such HEMs and/or other Processor Personal Data: (i) Provider is solely responsible for the accuracy of such data and the means by which it acquired such data, and for the legality of the instructions that it provides to Recipient; (ii) it has obtained all necessary consents and provided all necessary disclosures and opt-out opportunities to Data Subjects and Consumers as required under Data Privacy Laws; and (iii) the data shall not include any information relating to Data Subjects or Consumers who are minors, Data Subjects or Consumers who have opted out, or any information falling under the definition of “Sensitive Personal Information” or “Special Category Data” or similar designation under any Data Privacy Laws.

6. Security and Confidentiality.

Recipient shall implement appropriate technical and organizational measures to protect the Personal Data it receives from Provider from unauthorized, accidental or unlawful access, loss, disclosure or destruction. In the event that Recipient suffers a Personal Data Breach, it shall notify Provider without undue delay, but in any event within seventy-two (72) hours of it confirming same, and both Parties shall cooperate in good faith to agree and take such measures as may be necessary to mitigate or remedy the effects of the Personal Data Breach. Nothing herein prohibits either Party from providing notification of the Personal Data Breach to regulatory authorities as may be required by Data Privacy Laws prior to notification of the other Party so long as the notifying Party provides notification to the other Party without undue delay. Recipient shall ensure that all of its Personnel who have access to and/or Process such Personal Data are obliged to keep it confidential.

7. Data Subject Requests.

Each Party will process its own requests for Data Subjects to exercise their rights with respect to Controller Personal Data. With respect to requests from or on behalf of Data Subjects to the Processing of Controller Personal Data that is shared between the Parties, including requests to opt-out from the Sale or Sharing of Personal Information, the parties will collaborate to honor such objections or opt-out requests.

8. Compliance Cooperation.

Both Parties agree to reasonably cooperate and assist each other in relation to any regulatory inquiry, complaint or investigation concerning the Controller Personal Data shared between the Parties.

9. Allocation of Costs.

Each Party shall perform its obligations under this DPA at its own cost, except as otherwise specified herein.

10. Indemnity.

Each Party shall indemnify, defend and hold harmless the other Party and its officers, directors, agents and permitted successors and assigns from and against all costs, damages, expenses, liabilities, fines and penalties (collectively, “Losses”) resulting from or in connection with any claims, demands or investigations brought or made by any third party or regulatory authority (collectively, “Claims”) arising out of or in connection with: (i) any breach by the indemnifying Party, its Personnel and Subprocessors of Data Privacy Laws or any provisions of this DPA, and/or (ii) any Personal Data Breach to the extent caused by the indemnifying Party’s breach of its obligations under Section 6 and Exhibit B, or by the negligence or willful misconduct of the indemnifying Party, its Personnel or Subprocessors, in its capacity as Recipient. The indemnification obligations in this Section shall be subject to the limitations of liability in Section 11 and in the Main Agreement, and shall further be subject to the indemnification-related procedural requirements set forth in the Main Agreement, if any. This Section shall survive termination or expiration of this DPA and the Main Agreement.

11. Liability.

EXCEPT AS OTHERWISE EXPRESSLY SET FORTH IN THE MAIN AGREEMENT, IN NO EVENT WILL EITHER PARTY BE LIABLE FOR ANY CONSEQUENTIAL, INDIRECT, INCIDENTAL, PUNITIVE, SPECIAL OR EXEMPLARY DAMAGES WHATSOEVER, INCLUDING WITHOUT LIMITATION, DAMAGES FOR LOSS OF PROFITS, BUSINESS INTERRUPTION, LOSS OF INFORMATION AND THE LIKE, INCURRED BY THE OTHER PARTY ARISING OUT OF THIS DPA, EVEN IF SUCH PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

12. Miscellaneous.

If any provision or condition of this DPA is held or declared invalid, unlawful or unenforceable by a competent authority or court, then the remainder of this DPA shall remain valid. The provision or condition affected shall be construed to be amended in such a way that ensures its validity, lawfulness and enforceability while preserving the parties’ intentions, or if that is not possible, as if the invalid, unlawful or unenforceable part had never been contained in this DPA. This DPA shall be governed by and construed in accordance with the laws governing the Main Agreement, and any disputes shall be resolved by the courts agreed for resolution of disputes under the Main Agreement.

Exhibit A to DPA

I. CONTROLLER SERVICES

A. LIST OF PARTIES

1. Provider

Name and Address: Yieldmo, Inc. (including its Affiliates), 1 Tara Boulevard, Suite 200, Nashua, NH 03062

Contact person’s name and contact details: Lucid Privacy Group, Tel: (646) 485-0800 Email: dpo@yieldmo.com

Activities relevant to the data transferred under these clauses:

Controller Services: Provider may provide or make available the Controller Personal Data to Recipient for the following (the “Permitted Purposes”): to serve or facilitate display of advertising (“Ads”) to end users of media properties, including making ad requests and/or bid requests available to advertisers, agencies and other buyers (collectively, “Buyers”) to enable Buyers to decide whether and how much to bid and/or whether to place an Ad, to personalize such Ads to the inferred interests of users, including behavioral targeting, sequencing, scheduling, frequency capping and/or contextually targeting Ads, and to provide analytics, information and reporting regarding the performance of the Ads to Buyers and/or to the media property representative, and for service improvement and enhancement.

Role: Controller

2. Recipient

Name and address: the Company identified in the Main Agreement

Contact person’s name and contact details: as identified in the Main Agreement

Activities relevant to the data transferred under these clauses:

Controller Services: Recipient may Process the Controller Personal Data for the Permitted Purposes as described in Section 1 of this Exhibit.

Role: Controller

B. DESCRIPTION OF TRANSFER / PROCESSING ACTIVITIES

Categories of data subjects whose Personal Data is transferred

Controller Personal Data: end users of websites, mobile websites or applications on which the Controller Services are utilized

Categories of Personal Data transferred

Controller Services: pseudonymous data including IP addresses, cookie identifiers, device identifiers and mobile advertising IDs, which may be accompanied by other information about the Data Subjects whose Personal Data is being transferred, such as browser type and version, time stamp, device operating system and platform and country associated with the Data Subject.

Sensitive data transferred (if applicable)

• None.

The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis).

• Continuous and/or periodic (as selected by Provider)

Nature of the processing

• As set out under “Permitted Purposes” above.

Purpose(s) of the data transfer and further processing

• The Parties will process the Controller Personal Data as part of the Controller Services for the Permitted Purposes in accordance with the DPA and the Main Agreement.

The period for which the Personal Data will be retained, or, if that is not possible, the criteria used to determine that period

• The later of 13 months from the date of collection, or for the term of the Main Agreement (unless earlier deletion is required by the data exporter).

For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing

• See https://yieldmo.com/processor-list/

II. PROCESSOR SERVICES

A. LIST OF PARTIES

1. Provider

Name and Address: The entity identified as “Company” in the Main Agreement, having the address assigned to Company in the Main Agreement

Contact person’s name and contact details: as identified in the Main Agreement

Activities relevant to the data transferred under these clauses:

Processor Services: Provider may provide or make available the Processor Personal Data to Recipient for the purpose of assisting the Provider to perform cross context behavioral advertising.

Role: Controller

2. Recipient

Name and address: Yieldmo, Inc. (including its Affiliates), 1 Tara Boulevard, Suite 200, Nashua, NH 03062.

Contact person’s name and contact details: Lucid Privacy Group, Tel. (646) 485-0800, dpo@yieldmo.com

Activities relevant to the data transferred under these clauses:

Processor Services: Recipient may Process the Processor Personal Data as is necessary for the provision of the Processor Services to Provider in accordance with the DPA and the Main Agreement.

Role: Processor

B. DESCRIPTION OF TRANSFER / PROCESSING ACTIVITIES

Categories of data subjects whose Personal Data is transferred: end users of Provider’s website, individuals who have previously purchased Provider’s products or otherwise subscribed to Provider’s services.

Categories of Personal Data transferred

HEMs and/or cookie IDs derived by Provider independently and provided or made available to Recipient for the Processor Services.

Sensitive data transferred (if applicable)

• None.

The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis).

• Continuous and/or periodic (as selected by Provider)

Nature of the processing

• For ad targeting (e.g. to enable Recipient to use the Processor Personal Data to target advertisements to individuals who have previously purchased Provider’s products or otherwise subscribed to Provider’s services).

The period for which the Personal Data will be retained, or, if that is not possible, the criteria used to determine that period

• The later of 13 months from the date of collection, or for the term of the Main Agreement (unless earlier deletion is required by the data exporter).

For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing

• See https://yieldmo.com/processor-list/

Exhibit B to DPA

TECHNICAL AND ORGANISATIONAL MEASURES INCLUDING TECHNICAL AND ORGANISATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA

Recipient will implement and maintain a comprehensive written information security program designed to protect Personal Data from unauthorized access, use, modification, disclosure or destruction. Without limiting the generality of the foregoing, as part of its information security program, each party will:

• limit access to Personal Data to the minimum number of its personnel who require such access in order to perform its obligations under the DPA and the Main Agreement

• provide appropriate training to its personnel who process Personal Data

• use multi-factor authentication for access to any systems storing Personal Data

• use reputable services and/or tools to continuously monitor for malicious or unauthorized behavior

• encrypt Personal Data at rest and in transit

Version date: August 8, 2026