STANDARD DATA PROCESSING AGREEMENT

INTRODUCTION

This data processing agreement (the DPA) forms part of each contract regarding delivery of consultancy services and software services (the Main Agreement) by Etain AS, a Norwegian limited liability company with registration number 920 998 704 (theEtain), to Etain’s customer (the Customer).

Etain and the Customer are hereinafter jointly referred to as theParties, and each a Party.

This DPA shall be effective on the date of the Main Agreement (theEffective Date), as from which this DPA shall be deemed an integrated part of the Main Agreement.

To the extent there are conflicts or inconsistencies between this DPA and the Main Agreement, this DPA will prevail.

PROCESSING OF CUSTOMER PERSONAL DATA

The Customer hereby instructs Etain to process the Customer Personal Data necessary for Etain to fulfill its obligations pursuant to the Main Agreement and any other agreements entered into by the Parties.

The categories of Personal Data subject to processing under this DPA and the type of processing operations that will be carried out on behalf of the Customer is specified in Appendix 1 to this DPA.

Etain shall process Customer Personal Data in accordance with the Main Agreement, including the Service Level Policy, the General Terms and / or Consultancy Terms (as applicable) and any relevant Order Form. In addition, and notwithstanding anything to the contrary herein or in any other relevant agreement documents between the Parties, Etain shall always:

The Customer may at any time amend or withdraw the instruction to Process the Customer Personal Data, including by way of instruction to delete specific Customer Personal Data. Upon instruction to delete Customer Personal Data clause 10 applies accordingly.

ETAIN PERSONNEL

The Customer shall, without undue delay, notify Etain if the Customer discovers or becomes aware of circumstances which may constitute a breach of Etain’s obligations towards the CustoEtain shall take reasonable steps to ensure the reliability of any employee, agent or contractor of Etain or any Sub-Processor who may have access to the Customer Personal Data.

In any case, access shall be strictly limited to those individuals who need to know / access the relevant Customer Personal Data. Etain shall further ensure that all persons employed or otherwise hired by Etain, comply with the Service Level Policy with references and the Data Protection Laws.

SECURITY

Etain shall ensure that satisfactory information security is established in its own organization in accordance with the GDPR and the Service Level Policy through planned and systematic measures. Etain shall regularly, at least once per year, perform safety reviews and controls of the systems and measures implemented to process Personal Data. If the Customer requires information security measures which goes further than the GDPR requires which impose increased costs, work or similar on Etain, Etain may charge the Customer for such added services on market terms.

Etain shall also and nonetheless independently evaluate the risks related to the processing of Customer Personal Data and shall continuously implement required measures to mitigate those risks and ensure adequate information security taking the sensitive nature of such Customer Personal Information into account.

SUBPROCESSING

Etain shall generally be authorized to engage Sub-Processors to the extent necessary for complying with its obligations under the Main Agreement.

All Sub-Processors shall sign data processing agreements with Etain which at least imposes obligations on the Sub-Processor that are equivalent to those imposed on Etain under this DPA.

Etain shall provide the Customer with a written notice if it plans to appoint or remove any Sub-Processor(s) relevant for the services provided by Etain to the Customer. Such written notice shall be given in reasonable advance to the planned changes entering into force. The Customer may within reasonable time object in writing to the appointment or removal of a Sub-Processor. Such notice shall explain the reasonable grounds for the objection. In such event, the Parties shall discuss such concerns in good faith with a view to achieving commercially reasonable resolution. If this is not possible, either Party may terminate the DPA.

Upon request of the Customer, Etain shall provide the Customer with a list of the Sub-Processors used by Etain for the services relevant for the Customer, and copies of the data processing agreements made with such Sub-Processors. Clauses on business related issues that do not affect the processing of Personal Data in data processing agreements with the Sub-Processors may be left out of the disclosure to the Customer.

Etain shall use commercially reasonable efforts to ensure that the processing carried out by the Sub-Processor is in accordance with Data Protection Laws.

Etain shall remain fully liable to the Customer for its use of Sub-Processors.

DATA SUBJECT RIGHTS

Considering the nature of the Processing, Etain shall assist the Customer by implementing appropriate technical and organizational measures, insofar as this is commercially and reasonably possible, for the fulfilment of the Customer’s obligations, as reasonably understood by Etain, to respond to requests to exercise Data Subject rights under the Data Protection Laws. Hereunder, Etain shall:

Extra services in this relation shall be considered add-on services subject to payments and to be delivered under the Consultancy Terms unless otherwise agreed.

PERSONAL DATA BREACH

Etain shall notify the Customer without undue delay upon Etain becoming aware of any Personal Data Breach affecting the Customer Personal Data, providing the Customer with sufficient information to allow the Customer to meet any obligations to report or inform Data Subjects of the Personal Data Breach under the Data Protection Laws.

Etain shall co-operate with the Customer and take commercially reasonable steps as are directed by the Customer to assist in the investigation, mitigation, and remediation of each such Personal Data Breach.

DATA PROTECTION IMPACT ASSESSMENT AND PRIOR CONSULTATION

Etain shall provide reasonable assistance to the Customer with any data protection impact assessments, and prior consultations with Supervising Authorities or other competent data privacy authorities, which the Customer reasonably considers to be required by article 35 or 36 of the GDPR or equivalent provisions of any other Data Protection Law, in each case solely in relation to Processing of the Customer Personal Data by Etain or its Sub-Processors.

DELETION OR RETURN OF THE CUSTOMER PERSONAL DATA

Subject to this section 10, Etain shall promptly, and in any event within 10 business days of the date of cessation of any services involving the Processing of the Customer Personal Data (theCessation Date), delete and procure the deletion of all copies of such Customer Personal Data.

Customer Personal Data which is stored in back-up files shall be deleted within 90 days after receipt of such request.

Etain may keep Customer Personal Data necessary for Etain to fulfill its obligations towards the relevant Data Subject, or if otherwise requested by the Data Subject.

AUDIT RIGHTS

Etain shall at the Customer’s request make available to the Customer all information necessary to demonstrate compliance with the obligations laid down in Article 28 of the GDPR and allow for and contribute to audits, including inspections, conducted by the Customer or another auditor mandated by Customer. The Customer may, at its own expense, request an auditor’s report from an independent third party or an inspection according to the section below.

The Customer or a representative of the Customer shall have access to inspect the places where the processing of Personal Data is carried out by Etain (not including Sub-Processors), including physical facilities as well as systems used for and related to the processing to ascertain Etain’s compliance with Data Protection Laws and the DPA. Such an inspection shall be performed when the Customer deems it required, however always subject to reasonable notice.

Any costs, including costs incurred by Etain, relating to physical inspection shall be covered by the Customer.

The Data Processor shall be able to document the Sub-Processor’s compliance with its obligations towards the Data Processor with regards to the processing of Personal Data covered by this DPA.

The Data Processor shall without undue delay obtain and make available audit reports created by the Sub-Processors to ascertain the Sub-Processor’s compliance with applicable Data Protection Laws.

DATA TRANSFER

The Processor may not transfer or authorize the transfer of Data to countries outside the EU and/or the European Economic Area (EEA) without the prior written consent of the Customer. If personal data processed under this DPA is transferred from a country within the European Economic Area to a country outside the European Economic Area, the Parties shall ensure that the personal data are adequately protected. To achieve this, the Parties shall, unless agreed otherwise, rely on EU approved standard contractual clauses for the transfer of personal data.

TERM AND TERMINATION

Upon termination of the Main Agreement, this DPA shall be deemed terminated as well with the same effects as for the Main Agreement.

GENERAL TERMS

Etain may amend this DPA with three (3) months’ notice to the Customer. By not terminating the Main Agreement after the three months period the Customer shall be deemed to accept the amended the DPA as applicable as form the end of the three months’ notice period.

AMENDMENTS

Confidentiality

Each Party must keep this DPA and all information it receives about the other Party and its business in connection with this DPA (Confidential Information) strictly confidential and must not use or disclose that Confidential Information without the prior written consent of the other Party except to the extent that:

Notices

All notices and communications given under this DPA must be in writing and will be delivered personally, sent by post or by email to the address or email address set out in the heading of this DPA, or at such other address as notified from time to time by the Parties changing address.

GOVERNING LAW AND JURISDICTION

This DPA is governed by the laws of Norway.

Any dispute arising in connection with this DPA, which the Parties will not be able to resolve amicably, will be submitted to the exclusive jurisdiction of the ordinary courts of Norway, with Oslo district court as agreed legal venue.