Controller-To-Controller Data Protection Addendum (For Licensee)

This Data Protection Addendum (“Addendum”) is incorporated into the terms, and forms part of, the main agreement (and provisions incorporated therein) (the “Agreement”) between (1) the Stats Perform entity which is a party to the Agreement (“Stats Perform”) and (2) the licensee of materials provided by Stats Perform pursuant to the Agreement and which is a party to the Agreement (“Licensee”). The provisions of this Addendum shall apply where, for the purposes of Data Protection Legislation, Stats Perform shares personal data with the Licensee under the Agreement and each party in the Agreement is acting as controller.

Where there is conflict between the terms of the Agreement and this Addendum, the terms of this Addendum shall prevail. Subject to this, the Agreement will otherwise continue in full force and effect.

1. Definitions

For the purposes of this Addendum, the terms “controller”, “personal data” and “processing” shall have the meaning given to them in the UK GDPR and:

Data Protection Legislation

Means all statutes, laws, secondary legislation and regulations pertaining to privacy and/or data protection of personal data which are applicable to the parties, including, where applicable: (i) in respect of the EU, the General Data Protection Regulation (EU) 2016/679 (“EU GDPR“) and all relevant member state laws or regulations giving effect to, replacing or supplementing the same; (ii) in respect of the UK, the Data Protection Act 2018 (“UK DPA”), UK GDPR (which has the meaning given to it in the UK DPA) (“UK GDPR”) and the Privacy and Electronic Communications (EC Directive) Regulations 2003 (SI 2003/2426); and (iii) any applicable laws and regulations implementing, amending, extending, re-enacting, replacing, consolidating or supplementing the same from time to time.

EU SCCs

Means the European Commission’s Standard Contractual Clauses for the transfer of personal data to third countries pursuant to the EU GDPR as set out in the Annex to Commission Implementing Decision (EU) 2021/914 of 4 June 2021 (and available here by way of link), the relevant annexes of which are set out in this Addendum, or any set of clauses approved by the European Commission which amends, replaces, or supersedes these.

ICO UK Addendum

Means the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner under section 119A of the UK DPA which came into force on 21 March 2022 (and available here by way of link).

International Transfer

Means a transfer which is covered by Chapter V of the EU GDPR or UK GDPR (whichever is applicable).

International Transfer Clauses

Means the EU SCCs (and ICO UK Addendum where applicable).

2. Compliance with Data Protection Legislation

Each party agrees that it shall comply with its respective obligations as a controller under the Data Protection Legislation, and shall ensure that its employees, agents, and contractors shall observe all applicable obligations under Data Protection Legislation.

3. International Transfer Clauses

a) In the event that Stats Perform, or any affiliate within its corporate group, is subject to the EU GDPR and transfers personal data to the Licensee for processing outside the European Economic Area, and the transfer is an International Transfer and is not on the basis of an adequacy decision as described in Article 45 of the EU GDPR, then the parties will comply with the Module 1 version of the EU SCCs, which are deemed incorporated into, and form part of, this Addendum and completed as follows: (a) the optional redress language under Clause 11(a) of the EU SCCs will not apply; (b) option 1 will apply in respect of Clause 17 of the EU SCCs and the governing law is the Republic of Ireland; (c) the choice of forum and jurisdiction under Clause 18(b) of the EU SCCs are the courts of the Republic of Ireland; (d) Annexes I and II of the EU SCCs are deemed to be populated with the information set out in the EU SCCs Appendix below; and (e) Annex III of the EU SCCs will not apply.

b) In the event that Stats Perform, or any affiliate within its corporate group, is subject to the UK GDPR and transfers personal data to the Licensee for processing outside the UK, and the transfer is an International Transfer and is not on the basis of an adequacy decision as described in Article 45 of the UK GDPR, then the EU SCCs shall apply in accordance with sub-paragraph (a) above and shall be deemed amended as specified by the ICO UK Addendum, which shall be deemed executed by the parties and incorporated into, and form part of, this Addendum. Where the ICO UK Addendum applies in accordance with this sub-paragraph: (i) Tables 1 and 3 in Part 1 of the ICO UK Addendum shall be deemed completed with the relevant information set out in the Appendix to the EU SCCs and (therefore) the EU SCCs Appendix below; (ii) in Table 2 in Part 1, the “Addendum EU SCCs” are deemed to be the EU SCCs incorporated into this Addendum (in accordance with the aforementioned paragraph) including the Appendix Information (as defined in the ICO UK Addendum); (iii) Table 4 in Part 1 is deemed completed by selecting “neither party”; and (iv) any conflict between the terms of the EU SCCs and the ICO UK Addendum will be resolved in accordance with Sections 9, 10 and 11 of the ICO UK Addendum.

c) In the event the International Transfer Clauses (wholly or partly) are amended, repealed, replaced or superseded, or no longer provide a compliant means of transferring personal data to the Licensee under the Data Protection Legislation, the parties shall work together to put in place the necessary safeguards to ensure continued compliance under applicable Data Protection Legislation.

d) In the event of any conflict between the provisions of the International Transfer Clauses and this Addendum or the Agreement, then the International Transfer Clauses shall take precedence. The terms of the Agreement and the terms of this Addendum shall not, and do not seek to, vary the International Transfer Clauses in any way.

EU SCCs Appendix

ANNEX I

A. THE PARTIES

Data exporter (controller): Stats Perform, whose address, point of contact details, activities and signature (as applicable) are as set out in the Agreement (but contact email address for the purposes of the EU SCCs is privacy@statsperform.com).

Data importer (controller): the Licensee, whose address, point of contact details, activities and signature (as applicable) are as set out in the Agreement.

By agreeing to the terms of the Agreement, the parties agree and accept to be bound by the terms of this Addendum, and the International Transfer Clauses as applicable.

B. DESCRIPTION OF TRANSFER

Categories of data subject whose personal data is transferred: (i) athletes, professional sportspeople, and related sports professionals and (ii) Stats Perform and/or its affiliates’ personnel.

Categories of personal data transferred: in respect of athletes/sportspeople: This is likely to be information that allows the data exporter to compile statistical data and general information, or to provide other related commercial services to the Licensee as detailed in the Agreement. This includes: names, physical information, nationality, and statistical details of participation in sport. In respect of personnel: name and contact details (such as email addresses).

Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures: the data exporter does not generally seek to collect sensitive (or special category) data but may do so with regard to sporting injuries that may affect an athletes’ participation in sport. Any such special category personal data is subject to the technical and organisation measures set out in Annex II below.

The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis): on a continuous basis for the duration of the Agreement.

Nature and purpose(s) of the transfer and processing: the data exporter provides sports content related services to its customers, including the data importer, to benefit from those services. The purpose of the transfer is the provision of such sports content related services (which may involve the sharing of personal data).

The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period: the data exporter and data importer shall apply each of their respective personal data retention policies.

C. COMPETENT SUPERVISORY AUTHORITY

Subject to the ICO UK Addendum (where applicable), the competent supervisory authority in accordance with Clause 13 of the EU SCCs is the Irish Data Protection Commission.

ANNEX II – TECHNICAL AND ORGANISATIONAL MEASURES INCLUDING TECHNICAL AND ORGANISATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA

Without prejudice to its other security obligations as set out in the Agreement, the data importer shall:

(i) use appropriate, technical, and organisational measures to protect any personal data processed under the Agreement;

(ii) have authorised persons with appropriate training and permission to have access to personal data;

(iii) ensure there are secure and established controls to ensure ongoing security integrity, availability and resilience of processing systems and services;

(iv) have an established and organised incident response process that ensures timely notification and response to information security and/or personal data incidents;

(v) maintain internal policies, procedures and assessments which are designed to adhere to Data Protection Legislation and, among other aspects, to secure personal data against accidental or unlawful loss, access, or disclosure; and

(vi) have in place a process for regularly testing, assessing and evaluating the effectiveness of its technical and organisational measures, including training and communication to personnel, for ensuring the measures specified in this Annex II are in place.

ANNEX III – NOT APPLICABLE

SIGNED FOR AND ON BEHALF OF STATS PERFORM

Name of Stats Perform entity: Perform Content Limited

Signature: ____________________________________

Name of signatory: ____________________________________

Date: ____________________________________

Name of Licensee entity: ____________________________________