For purposes of this Agreement, the term "Personal Data" shall mean any information relating to an identified or identifiable natural person processed by the Processor on behalf of the Controller pursuant to the Principal Agreement, including, without limitation, any such information falling within the scope of applicable data protection laws, and the terms "data subject," "processing," "controller," "processor," "sub-processor," "personal data breach," and "supervisory authority" shall have the meanings ascribed to them under applicable data protection laws, including, where applicable, the GDPR.

The term "Applicable Data Protection Laws" shall mean all laws, regulations, and binding regulatory guidance applicable to the processing of Personal Data under this Agreement, including, without limitation and where applicable, the GDPR, the United Kingdom Data Protection Act 2018, state privacy laws of the United States, and any successor or implementing legislation thereto, as amended from time to time.

The term "Sub-Processor" shall mean any third party engaged by the Processor, or by any Sub-Processor of the Processor, to process Personal Data on behalf of the Controller in connection with the performance of the Processor's obligations under this Agreement or the Principal Agreement.

The term "Standard Contractual Clauses" or "SCCs" shall mean the standard contractual clauses for the transfer of personal data to third countries approved by the European Commission or any other competent authority, as the same may be amended, superseded, or replaced from time to time.

The headings used in this Agreement are for convenience of reference only and shall not affect the construction or interpretation of any provision hereof. Words importing the singular include the plural and vice versa, and words importing one gender include all genders. The words "include," "includes," and "including" shall be deemed to be followed by the words "without limitation."

In the event of any conflict or inconsistency between the provisions of this Agreement and the Principal Agreement with respect to the processing of Personal Data, the provisions of this Agreement shall prevail. In all other respects, the Principal Agreement shall remain in full force and effect.

Capitalized terms used but not otherwise defined herein shall have the meanings ascribed to them in the Principal Agreement.

The subject matter of the processing under this Agreement consists of the Processor's performance of the services described in the Principal Agreement, which services necessitate the processing of Personal Data on behalf of the Controller.

The duration of the processing shall commence on the Effective Date and shall continue for the term of the Principal Agreement, and thereafter for such additional period as may be reasonably necessary for the Processor to comply with its obligations under Section 13 of this Agreement regarding the deletion of Personal Data.

The nature of the processing shall comprise such operations as are necessary for the Processor to provide the services under the Principal Agreement, including, without limitation, collection, recording, organization, structuring, storage, adaptation, retrieval, consultation, use, transmission, disclosure, erasure, and destruction of Personal Data.

The purpose of the processing shall be strictly limited to the provision of the services under the Principal Agreement and such other purposes as may be expressly instructed in writing by the Controller from time to time.

The Processor acknowledges and agrees that it shall process Personal Data solely as a processor acting on behalf of the Controller and shall not process Personal Data for any purpose other than as set forth in this Agreement or as otherwise instructed in writing by the Controller.

The processing shall physically take place within the European Economic Area (EEA), provided that limited transfers of Personal Data outside the EEA may occur in accordance with Section 11 of this Agreement.

Nothing in this Agreement shall be construed as transferring ownership of, or any proprietary right or interest in, the Personal Data to the Processor, and all right, title, and interest in and to the Personal Data shall remain with the Controller and the respective data subjects.

The categories of data subjects whose Personal Data is processed under this Agreement include the Controller's employees, personnel, agents, and representatives, as well as the Controller's end users and customers who interact with the services provided under the Principal Agreement.

The categories of Personal Data processed under this Agreement include contact details (such as name, email address, telephone number, and postal address), account data (such as username, user identifiers, authentication credentials, and account preferences), and usage data (such as log data, device information, IP addresses, access timestamps, and records of activity within the services).

The Parties acknowledge that no special categories of Personal Data (such as data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, data concerning health, or data concerning a natural person's sex life or sexual orientation) are intended to be processed under this Agreement, unless the Parties expressly agree otherwise in writing.

The Controller shall not submit, upload, or otherwise cause to be processed any Personal Data falling within categories not contemplated by this Agreement without first obtaining the Processor's written consent, and the Processor shall not be deemed in breach of this Agreement for the processing of any such additional categories submitted by the Controller.

Should either Party identify a need to process additional or different categories of data subjects or Personal Data, the Parties shall negotiate in good faith to amend this Agreement in writing to reflect such change prior to the commencement of any such processing.

The Processor shall maintain reasonable records of the categories of data subjects and Personal Data processed under this Agreement in accordance with Section 12 hereof.

The Controller represents and warrants that it has obtained and shall maintain throughout the term of this Agreement all necessary consents, authorizations, and lawful bases required for the processing of Personal Data by the Processor as contemplated herein.

The Controller shall be solely responsible for the accuracy, quality, legality, and reliability of the Personal Data provided to or made accessible to the Processor, and for the means by which the Controller acquired such Personal Data.

The Controller shall provide the Processor with lawful, clear, documented, and complete instructions concerning the processing of Personal Data and shall ensure that such instructions comply with Applicable Data Protection Laws.

The Controller shall promptly notify the Processor in writing of any change in Applicable Data Protection Laws, regulatory guidance, or supervisory authority directives that may affect the Processor's processing activities hereunder, and the Parties shall cooperate in good faith to address such changes.

The Controller shall be responsible for providing all notices and obtaining all consents required under Applicable Data Protection Laws from data subjects in connection with the processing of Personal Data by the Processor.

The Controller shall respond, at its own cost, to inquiries from data subjects, supervisory authorities, and other third parties concerning the processing of Personal Data, except to the extent that the Processor is required to provide assistance under Section 9 of this Agreement.

The Controller shall indemnify and hold the Processor harmless from and against any claims, losses, liabilities, costs, and expenses arising out of or in connection with the Controller's breach of its obligations under this Section, subject to the limitations set forth in Section 14 hereof.

The Processor shall process Personal Data only on documented instructions from the Controller, including with regard to transfers of Personal Data to a third country or international organization, unless required to do otherwise by applicable law, in which case the Processor shall inform the Controller of such legal requirement before processing, unless prohibited by law from doing so on important grounds of public interest.

The Controller's initial instructions to the Processor regarding the processing of Personal Data are as set forth in this Agreement and the Principal Agreement. The Controller may issue additional written instructions from time to time, provided that such instructions are consistent with the scope and nature of the services and Applicable Data Protection Laws.

In the event the Processor reasonably believes that an instruction from the Controller violates Applicable Data Protection Laws, the Processor shall promptly inform the Controller in writing, and the Processor may, pending resolution of such matter, suspend the performance of the instruction in question without being deemed in breach of this Agreement.

The Processor shall not sell, rent, lease, or otherwise disclose Personal Data to any third party, nor use Personal Data for its own commercial purposes, marketing purposes, or any purpose other than performance of the services under the Principal Agreement.

The Processor shall implement appropriate internal procedures to ensure compliance with Applicable Data Protection Laws and with the Controller's instructions, and shall designate a point of contact for data protection matters, whose details shall be communicated to the Controller.

The Processor shall notify the Controller promptly if, in the Processor's reasonable opinion, compliance with the Controller's instructions would require the Processor to incur material additional costs not contemplated by the Principal Agreement, and the Parties shall negotiate in good faith regarding the allocation of such costs.

Any processing of Personal Data by the Processor outside the scope of the Controller's documented instructions shall be subject to prior written agreement between the Parties.

The Processor shall ensure that all personnel authorized to process Personal Data under this Agreement are bound by appropriate written obligations of confidentiality, whether contractual or statutory, and that such obligations survive the termination of such personnel's engagement with the Processor.

The Processor shall ensure that access to Personal Data is restricted to those personnel who have a need to access such Personal Data in order to perform the Processor's obligations under the Principal Agreement, and shall implement appropriate role-based access controls.

The Processor shall provide, and shall cause its personnel to receive, appropriate and ongoing training with respect to data protection, information security, and the proper handling of Personal Data.

The Processor shall not disclose Personal Data to any third party except as expressly permitted by this Agreement, with the Controller's prior written consent, or as required by applicable law.

In the event that the Processor is required by applicable law or legal process to disclose any Personal Data, the Processor shall, to the extent legally permissible, promptly notify the Controller in writing prior to such disclosure so that the Controller may seek a protective order or other appropriate remedy, and the Processor shall cooperate reasonably with the Controller in connection therewith.

The confidentiality obligations set forth in this Section shall survive the termination or expiration of this Agreement for so long as the applicable Personal Data remains in the possession or control of the Processor or its personnel.

The Processor shall implement and maintain appropriate technical and organizational measures designed to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of the processing, as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons.

The technical and organizational measures implemented by the Processor shall include, as appropriate: (i) pseudonymization and encryption of Personal Data, in transit and at rest, where appropriate; (ii) measures to ensure the ongoing confidentiality, integrity, availability, and resilience of processing systems and services; (iii) measures to restore the availability of and access to Personal Data in a timely manner in the event of a physical or technical incident; and (iv) processes for regularly testing, assessing, and evaluating the effectiveness of such measures.

The Processor shall maintain documented information security policies and procedures reflecting industry-recognized standards, and shall review and update such policies and procedures no less frequently than annually.

The Processor shall implement appropriate physical security controls at facilities where Personal Data is processed, including controlled access, environmental protections, and secure disposal of media containing Personal Data.

The Processor shall implement appropriate logical security controls, including, without limitation, authentication, authorization, logging, monitoring, intrusion detection, vulnerability management, and patch management.

The Processor shall conduct periodic risk assessments and shall take appropriate remedial actions to address identified risks in a timely manner.

The Processor may update or modify its technical and organizational measures from time to time, provided that any such update or modification shall not materially diminish the overall level of security provided for Personal Data under this Agreement.

The specific technical and organizational measures implemented by the Processor shall be documented in the Processor's internal security documentation, which may be made available to the Controller upon reasonable written request, subject to appropriate confidentiality undertakings.

The Controller hereby grants the Processor general prior written authorization to engage Sub-Processors for the processing of Personal Data in connection with the performance of the services under the Principal Agreement, subject to the terms and conditions of this Section.

The Processor shall maintain a current list of Sub-Processors engaged in the processing of Personal Data under this Agreement, which list shall be made available to the Controller upon written request or through such other means as the Processor may designate.

The Processor shall notify the Controller in writing of any intended addition or replacement of a Sub-Processor at least [30] days prior to such addition or replacement, thereby providing the Controller with the opportunity to object to such changes.

The Controller may, within [15] days following receipt of such notice, object in writing to the engagement of any new Sub-Processor on reasonable data protection grounds. The Parties shall thereafter cooperate in good faith to resolve such objection. If the Parties are unable to reach a resolution within [30] days, the Controller may, as its sole and exclusive remedy, terminate the affected portion of the services under the Principal Agreement upon written notice to the Processor.

The Processor shall enter into a written agreement with each Sub-Processor containing data protection obligations that are substantially equivalent to, and no less protective than, those imposed on the Processor under this Agreement.

The Processor shall remain fully liable to the Controller for the acts, omissions, and performance of any Sub-Processor engaged by the Processor, as if such acts, omissions, and performance were those of the Processor itself.

The Processor shall conduct reasonable due diligence on each Sub-Processor prior to engagement and shall periodically review the Sub-Processor's compliance with its data protection obligations.

Taking into account the nature of the processing, the Processor shall assist the Controller by appropriate technical and organizational measures, insofar as reasonably possible, for the fulfillment of the Controller's obligation to respond to requests from data subjects seeking to exercise their rights under Applicable Data Protection Laws.

In the event the Processor receives a request directly from a data subject in relation to Personal Data processed under this Agreement, the Processor shall, without undue delay and in any event within [5] business days, forward such request to the Controller and shall not respond substantively to such request unless expressly instructed to do so by the Controller or required by applicable law.

The Processor shall provide reasonable assistance to the Controller in responding to requests from data subjects, including requests for access, rectification, erasure, restriction of processing, data portability, and objection to processing.

The Processor may charge the Controller reasonable fees for the provision of assistance under this Section to the extent such assistance exceeds the Processor's standard functionality or involves material additional effort, provided that the Processor shall notify the Controller of such fees in advance.

Where the Processor's standard functionality permits, the Controller may itself address data subject rights requests through the use of such functionality without the need for assistance from the Processor.

The Processor shall not be responsible for determining whether a particular data subject request is valid or must be fulfilled, such determination being the sole responsibility of the Controller.

The Processor shall notify the Controller without undue delay, and in any event within [72] hours, after becoming aware of a personal data breach affecting Personal Data processed under this Agreement.

The Processor's notification shall, to the extent then known, describe: (i) the nature of the personal data breach, including, where possible, the categories and approximate number of data subjects and Personal Data records concerned; (ii) the likely consequences of the personal data breach; (iii) the measures taken or proposed to be taken by the Processor to address the personal data breach and to mitigate its possible adverse effects; and (iv) the contact details of the Processor's point of contact from whom further information may be obtained.

Where it is not possible to provide all such information at the same time, the Processor may provide the information in phases, without further undue delay.

The Processor shall take all commercially reasonable steps to contain, investigate, and remediate any personal data breach, and shall cooperate reasonably with the Controller in connection with the Controller's investigation, response, and notification obligations.

The Controller shall be solely responsible for determining whether any notification to supervisory authorities, data subjects, or other third parties is required under Applicable Data Protection Laws, and for making any such notifications.

The Processor shall maintain documented records of all personal data breaches, including the facts relating to the breach, its effects, and the remedial action taken, and shall make such records available to the Controller upon reasonable written request.

The Processor shall not make any public statement or notification concerning a personal data breach that identifies the Controller without the Controller's prior written consent, unless required by applicable law.

The Parties acknowledge that processing of Personal Data under this Agreement shall physically take place within the European Economic Area (EEA), and that any transfer of Personal Data outside the EEA shall be limited and shall occur only in accordance with this Section and Applicable Data Protection Laws.

The Processor shall not transfer Personal Data to any country outside the EEA, or to any international organization, except where such transfer is: (i) made to a jurisdiction that has been recognized as providing an adequate level of protection for Personal Data; (ii) subject to appropriate safeguards, including the Standard Contractual Clauses or binding corporate rules; or (iii) otherwise permitted by Applicable Data Protection Laws and this Agreement.

Where the Processor transfers Personal Data outside the EEA pursuant to this Section, the Processor shall ensure that appropriate contractual and technical safeguards are in place, including, where required, the execution of the Standard Contractual Clauses between the data exporter and data importer.

The Processor shall conduct, and shall document, appropriate transfer impact assessments where required by Applicable Data Protection Laws, and shall implement supplementary measures where necessary to ensure an essentially equivalent level of protection for Personal Data.

The Processor shall notify the Controller of any material change in the location of processing of Personal Data, including any new cross-border transfers, in accordance with the notification procedures set forth in Section 8 of this Agreement.

Should any transfer mechanism relied upon under this Section become invalid or be deemed to provide insufficient protection, the Parties shall cooperate in good faith to implement an alternative transfer mechanism without undue delay.

The Processor shall maintain a written record of processing activities carried out on behalf of the Controller, containing such information as is required under Applicable Data Protection Laws, and shall make such record available to the Controller or to a supervisory authority upon reasonable written request.

The Processor shall make available to the Controller all information reasonably necessary to demonstrate the Processor's compliance with its obligations under this Agreement, including the obligations set forth in this Agreement and under Applicable Data Protection Laws.

The Controller may, at its own cost and no more frequently than once per calendar year (except where required by a supervisory authority or following a personal data breach), audit the Processor's compliance with this Agreement, either by itself or through a mutually agreed independent third-party auditor bound by appropriate confidentiality obligations.

The Controller shall provide the Processor with not less than [30] days' prior written notice of any audit, and the Parties shall cooperate in good faith to agree on the timing, scope, duration, and procedures of such audit so as to minimize disruption to the Processor's operations.

The Processor may satisfy its audit obligations under this Section by providing the Controller with copies of relevant third-party certifications, attestations, audit reports (such as SOC 2 Type II reports or ISO 27001 certifications), and summaries of recent security assessments, provided that such documentation reasonably demonstrates the Processor's compliance with its obligations hereunder.

Audits shall be conducted during normal business hours, shall be subject to the Processor's reasonable security and confidentiality requirements, and shall not unreasonably interfere with the Processor's business operations or compromise the confidentiality or security of other customers' data.

Any findings arising from an audit shall be shared with the Processor, and the Parties shall discuss in good faith appropriate remedial measures to address any identified deficiencies.

The Controller shall bear the costs of any audit conducted pursuant to this Section, except where such audit reveals material non-compliance by the Processor with its obligations hereunder, in which case the Processor shall bear the reasonable costs of such audit.

Upon termination or expiration of the Principal Agreement, or upon the earlier written request of the Controller, the Processor shall, within [30] days thereafter, delete all Personal Data in its possession or control and shall cause its Sub-Processors to do the same.

The Processor's deletion obligations under this Section shall apply to all copies of Personal Data, including, without limitation, copies held in backup, archival, or disaster recovery systems, subject to the retention exceptions set forth below.

The Processor shall, upon the Controller's written request, provide written certification that the deletion of Personal Data has been completed in accordance with this Section.

Notwithstanding the foregoing, the Processor may retain Personal Data: (i) to the extent required by applicable law or legal process; or (ii) in encrypted or isolated form within backup or archival systems that are not readily accessible, provided that such retained Personal Data shall remain subject to the confidentiality, security, and other applicable obligations of this Agreement until actually deleted.

Prior to the Effective Date of such deletion, the Controller may request, in writing, that the Processor return a copy of the Personal Data in a commonly used, machine-readable format, provided that the Controller shall reimburse the Processor for reasonable costs associated with such return.

The Processor shall not be required to delete Personal Data to the extent such data has been irreversibly anonymized such that it no longer constitutes Personal Data under Applicable Data Protection Laws.

The total aggregate liability of each Party arising out of or in connection with this Agreement, whether in contract, tort (including negligence), strict liability, or otherwise, shall be limited to the total fees paid or payable by the Controller to the Processor under the Principal Agreement during the [12]-month period immediately preceding the event giving rise to the claim.

In no event shall either Party be liable to the other for any indirect, incidental, consequential, special, exemplary, or punitive damages, including loss of profits, loss of revenue, loss of business, loss of goodwill, or loss of data, arising out of or in connection with this Agreement, even if such Party has been advised of the possibility of such damages.

The limitations of liability set forth in this Section shall not apply to: (i) liability arising from a Party's willful misconduct, fraud, or gross negligence; (ii) a Party's indemnification obligations expressly set forth in this Agreement; or (iii) any liability that cannot be limited or excluded under applicable law.

Each Party shall indemnify, defend, and hold harmless the other Party and its affiliates, officers, directors, employees, and agents from and against any and all third-party claims, damages, liabilities, losses, costs, and expenses (including reasonable attorneys' fees) arising out of or resulting from the indemnifying Party's material breach of its obligations under this Agreement or its violation of Applicable Data Protection Laws, subject to the limitations set forth in this Section.

A Party seeking indemnification hereunder shall: (i) promptly notify the indemnifying Party in writing of the claim; (ii) grant the indemnifying Party sole control of the defense and settlement of the claim, provided that no settlement imposing non-monetary obligations on the indemnified Party may be entered into without the indemnified Party's prior written consent; and (iii) provide the indemnifying Party with reasonable cooperation and assistance at the indemnifying Party's expense.

If both Parties are responsible for an event giving rise to damages, each Party shall be liable only for its proportionate share of such damages based on its respective degree of fault.

The limitations and exclusions of liability set forth in this Section reflect an informed, voluntary allocation of risk between the Parties and shall apply notwithstanding the failure of any limited or exclusive remedy of its essential purpose.

This Agreement shall commence on the Effective Date and shall remain in full force and effect for the duration of the Principal Agreement, unless earlier terminated in accordance with the provisions hereof.

This Agreement shall automatically terminate upon the termination or expiration of the Principal Agreement, provided that any provisions of this Agreement which by their nature are intended to survive such termination shall so survive.

Either Party may terminate this Agreement upon written notice to the other Party in the event the other Party materially breaches its obligations under this Agreement and fails to cure such breach within [30] days after receipt of written notice specifying the breach.

The Controller may terminate this Agreement in accordance with Section 8 hereof in the event the Controller objects to the engagement of a new Sub-Processor and the Parties are unable to reach a mutually acceptable resolution.

Upon any termination of this Agreement, the Processor shall comply with the obligations set forth in Section 13 hereof regarding the deletion of Personal Data.

The termination of this Agreement shall not relieve either Party of any obligations accrued prior to the effective date of termination, nor of any obligations expressly stated to survive termination, including the obligations set forth in Sections 6, 13, 14, and 16.

Neither Party shall be entitled to any compensation or damages solely by reason of the termination or expiration of this Agreement in accordance with its terms.

This Agreement shall be governed by and construed in accordance with the laws of the State of [Governing Law State], United States of America, without regard to its conflict of laws principles, provided that the mandatory provisions of Applicable Data Protection Laws shall continue to apply where required.

Any dispute, controversy, or claim arising out of or in connection with this Agreement, including its interpretation, performance, breach, termination, or validity, shall first be addressed through good-faith negotiation between designated representatives of the Parties for a period of not less than [30] days.

If the Parties are unable to resolve the dispute through negotiation, the dispute shall be submitted to binding arbitration administered by [Arbitration Institution] in accordance with its then-current commercial arbitration rules, before a single arbitrator, in [City, State], United States, and conducted in the English language.

The award rendered by the arbitrator shall be final and binding on the Parties, and judgment thereon may be entered in any court of competent jurisdiction.

Notwithstanding the foregoing, either Party may seek injunctive or other equitable relief in any court of competent jurisdiction to prevent or restrain actual or threatened breach of this Agreement.

Each Party shall bear its own costs and expenses incurred in connection with any dispute resolution proceedings, except that the arbitrator shall have the authority to award reasonable attorneys' fees and costs to the prevailing Party.

The Parties hereby irrevocably waive any right to a trial by jury in any proceeding arising out of or in connection with this Agreement to the extent such waiver is permitted by applicable law.

This Agreement, together with the Principal Agreement, constitutes the entire agreement between the Parties with respect to the subject matter hereof and supersedes all prior and contemporaneous agreements, understandings, representations, and warranties, whether written or oral, relating to the subject matter hereof.

No amendment, modification, or waiver of any provision of this Agreement shall be effective unless in writing and signed by duly authorized representatives of both Parties.

If any provision of this Agreement is held to be invalid, illegal, or unenforceable by a court or arbitrator of competent jurisdiction, such provision shall be modified to the minimum extent necessary to render it valid, legal, and enforceable, and the remaining provisions of this Agreement shall continue in full force and effect.

No failure or delay by either Party in exercising any right, power, or remedy under this Agreement shall operate as a waiver thereof, nor shall any single or partial exercise of any such right, power, or remedy preclude any other or further exercise thereof.

Neither Party may assign, transfer, or delegate this Agreement or any of its rights or obligations hereunder without the prior written consent of the other Party, except that either Party may assign this Agreement without such consent to an affiliate or in connection with a merger, acquisition, or sale of all or substantially all of its assets.

All notices required or permitted under this Agreement shall be in writing and shall be delivered by hand, by certified mail (return receipt requested), by reputable overnight courier, or by electronic mail with confirmation of receipt, to the addresses specified in the introduction to this Agreement or to such other address as either Party may designate in writing.

Nothing in this Agreement shall be deemed to create any partnership, joint venture, agency, employment, or fiduciary relationship between the Parties, and neither Party shall have the authority to bind the other except as expressly provided herein.

This Agreement may be executed in one or more counterparts, each of which shall be deemed an original, and all of which together shall constitute one and the same instrument. Signatures delivered by electronic means (including PDF or recognized electronic signature platforms) shall be deemed valid and binding to the same extent as original signatures.

Neither Party shall be liable for any failure or delay in performance under this Agreement (other than payment obligations) to the extent such failure or delay is caused by circumstances beyond its reasonable control, including acts of God, war, terrorism, civil unrest, pandemics, governmental action, or utility or telecommunications failures.