Master License Agreement – CONTROLLER-TO-PROCESSOR DATA PROCESSING ADDENDUM

STATS PERFORM – CONTROLLER-TO-PROCESSOR DATA PROCESSING ADDENDUM TO TEAM PERFORMANCE MASTER LICENCE AGREEMENT

This Controller-to-Processor Data Processing Addendum, including any Appendices, Annexes and Schedules attached hereto (together the “DPA”), where applicable, forms part of, and is incorporated in, the Team Performance Master Licence Agreement (“MLA“), Work Order and/or (if applicable) any other agreement (together the “Agreement”) in connection with certain services of the Platform-Accessed Services (as referred in the Work Order and MLA) provided to you (referred to as “Licensee”, “you” or “your”) pursuant to the Agreement where you are data controller and either Perform Content Limited or the relevant Affiliate which is party to the Agreement (the relevant party referred to as “Stats Perform” or “we”, “us” or “our”) acts as data processor.

Where there is conflict between the terms of the MLA and this DPA, the terms of this DPA shall prevail. Subject to this, the MLA will otherwise continue in full force and effect.

NOW IT IS HEREBY AGREED as follows:

1. DEFINITIONS

1.1. In this DPA, capitalised words shall have the meaning as set out below or, as the case may be, elsewhere in the Agreement:

1.2. The terms “data subject”, “personal data”, “processing” and variations, “controller” and “processor” shall have the meaning attributed to them in Data Protection Law.

2. APPOINTMENT

2. 1. In the course of Stats Perform providing the Services to the Licensee, the Licensee may provide or input into the Services Licensee Personal Data for processing. For such purposes, the Licensee is the controller and Stats Perform is the processor and this DPA applies in such circumstances. The subject matter of processing of Licensee Personal Data to be carried out by Stats Perform on behalf of the Licensee (including the nature, purpose, duration and other aspects) is set out in the Schedule to this DPA.

2.2. Licensee Personal Data may contain personal data in relation to which Licensee Affiliates are controllers. The Licensee confirms that it is authorized to communicate to Stats Perform any instructions or other requirements on behalf of Licensee Affiliates in respect of processing of Licensee Personal Data by Stats Perform in connection with the Services.

2.3. Stats Perform is appointed by the Licensee to process Licensee Personal Data on behalf of the Licensee and/or Licensee Affiliates, as the case may be, as is necessary to provide the Services or as otherwise agreed by the parties in writing.

2.4. The Licensee acknowledges that it, together with any of its Affiliates, are solely responsible for ensuring, and the Licensee warrants and represents, that, in accordance with Data Protection Law, any processing of Licensee Personal Data is carried out under an appropriate lawful ground, the appropriate notices pursuant to the processing of that data are provided to the relevant data subjects, the Licensee Personal Data is accurate and up-to-date, and appropriate data retention periods are defined and implemented in respect of that data.

3. DURATION

This DPA shall apply from the Effective Date and shall continue in full force and effect until the termination or expiration of the Agreement or the Services (the “Term”).

4. DATA PROTECTION COMPLIANCE

4.1. In relation to its processing of Licensee Personal Data as processor during the Term, save as otherwise required by law, Stats Perform agrees to:

4.1.1. comply with applicable Data Protection Law in relation to its processing of Licensee Personal Data;

4.1.2. process Licensee Personal Data only as required in connection with the provision of the Services, in accordance with the Licensee’s documented lawful instructions reasonably given in the context of the Services from time to time, and for its internal business analysis of anonymised data. Stats Perform may otherwise be required to process Licensee Personal Data in accordance with applicable law to which it is subject and, in such case, it shall inform the Licensee of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest. The Licensee warrants and represents on a continuous basis that its instructions will not put Stats Perform in breach of the law;

4.1.3. inform the Licensee if, in its opinion, an instruction infringes Data Protection Law, and Stats Perform has the right to disregard such instruction;

4.1.4. ensure that all personnel authorised by Stats Perform to process Licensee Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;

4.1.5. implement appropriate technical and organisational measures (pursuant to the measures set out in the Schedule to this DPA) to appropriately safeguard Licensee Personal Data having regard to the nature of Licensee Personal Data which is to be protected and the risk of harm which might result from any Security Breach (as defined below);

4.1.6. inform, without undue delay, the Licensee of any data subject requests it receives under Data Protection Law or regulatory or law enforcement requests relating to Licensee Personal Data. Stats Perform may acknowledge each data subject request. Where agreed with the Licensee, Stats Perform may, at Licensee’s expense, assist the Licensee by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the Licensee’s obligation to respond to data subject requests made under Data Protection Law;

4.1.7. at Licensee’s expense, provide such assistance as the Licensee may reasonably require in order to ensure the Licensee’s compliance with Data Protection Law in relation to data security, data breach notifications, data protection impact assessments and prior consultations with competent supervisory authorities with responsibility for privacy and data protection matters;

4.1.8. at the choice and expense of the Licensee, delete Licensee Personal Data or return all Licensee Personal Data to the Licensee after the end of the provision of Services, and delete existing copies of all Licensee Personal Data, save for anonymised Licensee data retained for legitimate business purposes or Licensee Personal Data required for on-going storage under applicable law; and

4.1.9. at Licensee’s expense, make available to Licensee information reasonably necessary to demonstrate Stats Perform’s compliance with this DPA and allow for audits and inspections carried out by an independent third party, on reasonable notice as the parties may agree. Where exercising its right of audit pursuant to this clause, the Licensee shall, and shall ensure a party performing an audit shall, subject to clause 5: (a) carry out audits only during the general business hours of Stats Perform’s or its Affiliate’s location where the audit is performed; (b) use all reasonable care to ensure undisturbed business operations when carrying out the audits, especially to ensure that risks to another client’s environment (e.g. impact on service levels, availability of data, confidentiality aspects) are avoided or mitigated; (c) observe any applicable provisions of Data Protection Law and reasonable requirements of Stats Perform; (d) exercise the audit rights in a proportional manner, taking into account the complexity of the Services, the risks arising from the Services, the criticality or importance of the Services, and the potential impact of the Services on the continuity of Licensee’s activities; (e) adhere to relevant, commonly accepted, national and international audit standards; (f) ensure that its employees or any third-party auditor possess the appropriate and relevant skills and knowledge to perform the audit; and (g) treat all information shared under this sub-clause as Confidential Information.

5. AUDIT

With regards to clause 4.1.9 above, in relation to its Sub-processors, Stats Perform will exercise its audit rights (pursuant to meeting the requirements of Article 28(3)(h) of the EU GDPR or UK GDPR (as applicable)) subject to its agreement with its sub-Processors. At its own discretion but with due consideration of the legal obligations of the Licensee, Stats Perform shall have the right to refrain from disclosing information if such information is sensitive to Stats Perform’s business or if Stats Perform would violate statutory or contractual obligations by disclosing such information. In particular, Stats Perform shall not grant the Licensee access to any data or information about Stats Perform’s Licensees, about Stats Perform’s costs, about quality and contract management reports or about any other information that is not strictly necessary for the agreed inspection purposes.

6. SUB-PROCESSORS

6.1. Stats Perform will engage any subcontractors involved in the processing of Licensee Personal Data under this DPA (each a “Sub-processor”) in accordance with this clause 6.

6.2. The current list of Sub-processors engaged in processing Licensee Personal Data for the performance of certain data processing activities under this DPA, is listed in the Schedule (as updated from time to time). As of the Effective Date, the Licensee hereby consents to the use of these Sub-processors as it pertains to Licensee Personal Data of the Licensee.

6.3. Stats Perform shall duly inform the Licensee of any new, or replacement, Sub-processor(s) which is different to the list of Sub-processors in the Schedule and affects the processing of the Licensee Personal Data. If the Licensee objects to any such change on reasonable grounds, it must notify Stats Perform within 14 days of being informed by Stats Perform in accordance with this clause, otherwise the change will be deemed accepted. In the event of any objection reasonably raised in accordance with this clause, the Parties shall enter into good faith discussions to agree a workaround. However, if no such workaround is agreed in Stats Perform’s reasonable opinion, Stats Perform shall be entitled to terminate the Services relating to the change in Sub-processor.

6.4. When engaging a Sub-processor, Stats Perform will:

6.4.1. carry out reasonable due diligence;

6.4.2. enter into a contract on terms, as far as practicable, which are substantially equivalent to those in this DPA, and which may include International Transfer Clauses (or similar) where required, to provide adequate safeguards with respect to the processing of Licensee Personal Data; and

6.4.3. remain fully liable to the Licensee for the Sub-processor’s performance of its data processing obligations under this DPA.

7. SECURITY INCIDENTS

7.1. “Security Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Licensee Personal Data transmitted, stored or otherwise processed by Stats Perform.

7.2. Stats Perform will notify the Licensee without delay if it becomes aware of any Security Breach. Where practicable, Stats Perform will provide phased notifications.

7.3. Stats Perform will investigate the Security Breach and take reasonable action to identify, prevent and mitigate the effects of the Security Breach. At the Licensee’s expense, Stats Perform will take such further action as the Licensee may reasonably request in order to comply with Data Protection Law.

7.4. Subject to requirements of Data Protection Law, the Licensee may not release or publish any filing, communication, notice, press release, or report concerning any Security Breach without Stats Perform’s prior written approval; such approval shall not be unreasonably withheld.

8. INTERNATIONAL DATA TRANSFERS

8.1. The Licensee acknowledges that Stats Perform may make International Transfers of Licensee Personal Data. Stats Perform will ensure that any International Transfer, to the extent it occurs, is based on appropriate safeguards under applicable Data Protection Law, including where necessary entering into the appropriate International Transfer Clauses (or alternative standard contractual clauses) with the relevant importer.

8.2. In the event that the Licensee is subject to the EU GDPR and transfers Licensee Personal Data to Stats Perform for processing outside the European Economic Area, and the transfer is an International Transfer and is not on the basis of an adequacy decision as described in Article 45 of the EU GDPR, then the parties will comply with the Module 2 (or, if applicable, Module 3) version of the EU SCCs, which are deemed incorporated into, and form part of, this DPA and completed as follows:

8.2.1. Clause 7 of the EU SCCs (the Docking clause) will not apply;

8.2.2. option 2 will apply in respect of Clause 9(a) of the EU SCCs where the ‘agreed list’ is set out in the Schedule and the time period is 14 days;

8.2.3. the optional redress language under Clause 11(a) of the EU SCCs will not apply;

8.2.4. where applicable, the competent supervisory authority in accordance with Clause 13 of the EU SCCs is the Irish Data Protection Commission;

8.2.5. option 2 will apply in respect of Clause 17 of the EU SCCs and the applicable governing law is the Republic of Ireland;

8.2.6. the choice of forum and jurisdiction under Clause 18(b) of the EU SCCs are the courts of the Republic of Ireland; and

8.2.7. Annexes I and II of the EU SCCs are deemed to be populated with the information set out in the Schedule below.

8.3. In the event that the Licensee is subject to the UK GDPR and transfers Licensee Personal Data to Stats Perform for processing outside the UK, and the transfer is an International Transfer and is not on the basis of an adequacy decision as described in Article 45 of the UK GDPR, then the EU SCCs shall apply in accordance with clause 8.2 above and shall be deemed amended as specified by the ICO UK Addendum, which shall be deemed executed by the parties and incorporated into, and form part of, this DPA. Where the ICO UK Addendum applies in accordance with this clause 8.3:

8.3.1. Tables 1 and 3 in Part 1 of the ICO UK Addendum shall be deemed completed with the relevant information set out in the Appendix to the EU SCCs and (therefore) the Schedule below;

8.3.2. in Table 2 in Part 1, the “Addendum EU SCCs” are deemed to be the EU SCCs incorporated into this DPA (in accordance with Clause 8.2 above) including the Appendix Information (as defined in the ICO UK Addendum);

8.3.3. Table 4 in Part 1 is deemed completed by selecting “neither party”; and

8.3.4. any conflict between the terms of the EU SCCs and the ICO UK Addendum will be resolved in accordance with Sections 9, 10 and 11 of the ICO UK Addendum.

8.4. Where the International Transfer Clauses apply, their respective provisions shall replace Stats Perform’s data processing obligations (including as set out in clauses 4 to 7) of this DPA. In the event of any conflict between the provisions of the International Transfer Clauses and this DPA or the Agreement, then the International Transfer Clauses shall take precedence. The terms of the Agreement and the terms of this DPA shall not, and do not seek to, vary the International Transfer Clauses in any way.

9. INDEMNITY

9.1. Notwithstanding any exclusion or limitation of liability or any provision in the Agreement to the contrary, the Licensee shall and hereby agrees to indemnify Stats Perform and its Affiliates and their officers, employees, agents and subcontractors (each an “Indemnified Party”) from and against any claims, losses, demands, actions, liabilities, fines, penalties, reasonable expenses, damages and settlement amounts (including reasonable legal fees and costs) incurred by any Indemnified Party as a result of any third party claim, enforcement action or other proceedings arising out of or in connection with the processing of Licensee Personal Data in accordance with the Agreement and this DPA.

9.2. Subject to clauses 9.1 and 10.2, either party’s liability under this DPA shall be subject to any limitation of liability provisions in the Agreement.

10. MISCELLANEOUS

10.1. Clause titles and other headings in this DPA are for convenience of reference only and shall not constitute a part of or otherwise affect the meaning or interpretation of this DPA.

10.2. Nothing in this DPA will exclude or limit the liability of either party which cannot be limited or excluded by applicable law. Subject to the foregoing sentence, (i) this DPA, including any schedules, annexes and appendices, constitute the entire agreement between the parties pertaining to the subject matter hereof and supersedes all prior agreements, understandings, negotiations and discussions of the parties relating to its subject matter; and (ii) in entering into this DPA neither party has relied on, and neither party will have any right or remedy based on, any statement, representation or warranty, whether made negligently or innocently, except those expressly set out in this DPA.

10.3. The Licensee shall pay to Stats Perform within 30 days of invoice date any costs and expenses including without limitation reasonable attorney fees and the cost of preparing and sending correspondence incurred by Stats Perform and/or its Affiliates in connection with carrying out duties at the Licensee’s expense under this DPA.

10.4. All notices of termination or breach must be in English, in writing and addressed to the other party’s primary contact person and legal department. Notice will be treated as given on receipt, as verified by a valid receipt or electronic log. Postal notices will be deemed received 48 hours from the date of posting by recorded delivery of registered post.

10.5. The provisions of this DPA are severable. If any phrase, clause or provision is invalid or unenforceable in whole or in part, such invalidity or unenforceability shall affect only such phrase, clause or provision, and the rest of this DPA shall remain in full force and effect.

10.6. This DPA is governed by English law and the parties submit to the exclusive jurisdiction of the English courts in relation to any dispute (contractual or non-contractual) concerning this DPA, excepting those disputes arising out of Section 8 providing alternate forums for relief, save that either party may apply to any court for an injunction or other relief to protect its property, intellectual property rights or confidential information

SCHEDULE

DATA PROCESSING PARTICULARS