Data Processing Agreement (DPA)

This Data Processing Agreement (the "Agreement" or "DPA") is entered into by and between:

• SMTM LAB LLC, a limited liability company organized under the laws of the State of Florida, United States, with its address at 9826 Introduction Way, Orlando, FL 32832, United States, which operates the AgentsPayouts platform ("SMTM" or the "Processor"); and
• the Agency (also referred to as the "Customer" in the Terms and Conditions of Use), meaning the legal entity or independent travel agent that subscribes to the Service and whose identifying details are recorded in its AgentsPayouts account (the "Agency" or the "Controller").

SMTM and the Agency are jointly referred to as the "Parties" and individually as a "Party".

This Agreement forms part of the AgentsPayouts Terms and Conditions of Use (the "Terms") and supplements them with respect to the processing of Personal Data that SMTM carries out on behalf of the Agency.

1. Definitions

1.1. Capitalized terms not defined in this Agreement have the meanings given to them in the Terms.

1.2. For the purposes of this Agreement:

a) "Data Protection Law": any personal data protection or privacy law applicable to the processing covered by this Agreement, including, to the extent applicable: (i) Regulation (EU) 2016/679 (the "GDPR"); (ii) the GDPR as incorporated into United Kingdom law and the Data Protection Act 2018 (the "UK GDPR"); (iii) the Swiss Federal Act on Data Protection (the "Swiss FADP"); (iv) United States state privacy laws, including the California Consumer Privacy Act as amended by the California Privacy Rights Act (the "CCPA"), and the laws of the State of Florida; and (v) the data protection laws of other countries in which the Agency operates.

b) "Personal Data": any information relating to an identified or identifiable natural person, or that applicable law defines as personal data or personal information.

c) "Agency Personal Data": the Personal Data that SMTM processes on behalf of and under the instructions of the Agency in providing the Service, as described in Annex I. It does not include Personal Data for which SMTM acts as an independent controller under Section 2.3.

d) "Processing" or "process": any operation or set of operations performed on Personal Data, whether or not by automated means, such as collection, recording, organization, storage, retrieval, use, disclosure, erasure or destruction.

e) "Controller", "Processor", "Data Subject" and "Supervisory Authority": have the meanings given to them in the applicable Data Protection Law. Where such law uses equivalent terms (for example, "business" and "service provider" under the CCPA, or "controller" and "processor" under other U.S. state laws), those terms are included.

f) "End Client": the Agency's traveler, client or prospective client whose data is entered into the platform, including their companions or members of their family group.

g) "User": any person authorized by the Agency to access the platform (administrators and agents), in accordance with the Terms.

h) "Sub-processor": any third party engaged by SMTM that processes Agency Personal Data in order to provide the Service.

i) "Personal Data Breach": a breach of security leading to the accidental or unlawful destruction, loss or alteration of, or unauthorized disclosure of or access to, Agency Personal Data while under the control of SMTM or its Sub-processors.

j) "EU SCCs": the standard contractual clauses for the transfer of personal data to third countries approved by Commission Implementing Decision (EU) 2021/914 of 4 June 2021, or any successor clauses.

k) "UK Addendum": the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the United Kingdom Information Commissioner's Office (ICO) under section 119A of the Data Protection Act 2018, or any successor instrument.

2. Subject Matter and Roles of the Parties

2.1. Subject matter. This Agreement governs the Parties' obligations regarding the Processing of Agency Personal Data that SMTM carries out in providing the AgentsPayouts Service (web application and mobile application).

2.2. Traveler and End Client data. With respect to traveler and End Client data processed on behalf of and under the instructions of the Agency, the Agency acts as Controller and SMTM acts as Processor. The Agency is responsible for having a valid legal basis and for providing the privacy notices and obtaining the consents or authorizations that may be required.

2.3. SMTM as independent controller. SMTM may act as an independent controller with respect to data it processes to manage accounts, billing, security, fraud prevention, audit logs and compliance with its own legal obligations, including, by way of example: Users' account data (name, email address, role, credentials, authentication factors), subscription billing data, access and audit logs, evidence of acceptance of legal documents, support communications, and aggregated or de-identified data under Section 4.4. Such processing is governed by the AgentsPayouts Privacy Policy and not by this Agreement.

2.4. Agency Users. Users act under the authority of the Agency. The Agency is responsible for authorizing and revoking their access and for ensuring that they process Personal Data in accordance with Section 5.2 of the Terms, the Usage and Confidentiality Policy and the Agency's instructions.

2.5. Independent agent. Where the Customer is an independent travel agent subscribing to the Service in their own name, this Agreement applies to them as Controller of their End Clients' data.

3. Duration

3.1. This Agreement takes effect on the date on which an authorized representative of the Agency accepts it in accordance with Section 20 and remains in force for as long as SMTM processes Agency Personal Data, including the period following termination of the Terms during which the return and deletion provided for in Section 13 are carried out.

3.2. Obligations which by their nature should survive (in particular confidentiality, deletion, audit and liability) shall survive termination.

4. Purpose and Documented Instructions

4.1. Purpose. SMTM shall process Agency Personal Data only to provide, maintain, secure and support the Service in accordance with the Terms, this Agreement and the Agency's documented instructions, including recording bookings and sales, calculating and settling commissions, managing clients, proposals, leads and reminders, sending transactional emails and notifications, and the other Service features that the Agency chooses to use.

4.2. Documented instructions. The Agency's documented instructions consist of: (a) the Terms and this Agreement; (b) the configuration and use of the Service's features by the Agency and its Users; and (c) any other reasonable instruction that the Agency communicates in writing and that is consistent with the Service. Additional instructions involving unforeseen costs or development may be subject to agreement between the Parties.

4.3. Unlawful instructions. SMTM shall inform the Agency without delay if, in its opinion, an instruction infringes Data Protection Law, and may suspend its execution until the Agency confirms or amends it. SMTM is not required to perform a legal review of the Agency's instructions.

4.4. Aggregated or de-identified data. SMTM may generate aggregated or de-identified information from use of the Service to maintain, secure and improve the Service, provided that such information does not identify, and cannot reasonably be used to identify, the Agency, its Users or End Clients. SMTM shall take reasonable measures not to re-identify such information.

4.5. Legal requirement. SMTM may process Agency Personal Data where required to do so by applicable law. In such case, it shall inform the Agency of that legal requirement before processing, unless the law prohibits it.

4.6. Prohibitions. SMTM shall not sell Agency Personal Data or share it for cross-context behavioral advertising, nor use it for its own purposes other than those provided for in this Agreement.

5. Obligations of the Agency

5.1. The Agency represents and warrants that:

a) it has a valid legal basis for processing the Personal Data it enters, or allows to be entered, into the platform, and is responsible for providing the privacy notices and obtaining the consents or authorizations that may be required;

b) it enters only data that is adequate, relevant and limited to what is reasonably necessary to manage trips, bookings, sales, commissions and other authorized activities;

c) where the data relates to minors, it ensures that the data has been provided by a parent, guardian, legal representative or adult legally authorized to manage the booking, as applicable under applicable law, and limits such data to what is reasonably necessary to manage the trip;

d) it does not enter, or allow to be entered, information that the platform does not expressly request, including full passport or identity document numbers, Social Security numbers, full payment card data, security codes, access credentials, or medical, biometric, religious or other special categories of data or sensitive data. Preference, note and comment fields must not be used to record this type of information;

e) where it uses any marketing communication features with End Clients that the Service may offer in the future, it is responsible for obtaining and recording the consent or other legal basis required for such communications; and

f) its instructions to SMTM comply with Data Protection Law.

5.2. The Agency is responsible for configuring its Users' access, for promptly revoking the access of those who cease to be authorized, and for the accuracy of the data it enters.

6. Confidentiality of Personnel

6.1. SMTM shall ensure that persons authorized to process Agency Personal Data (employees, contractors or support staff) (a) access it only to the extent necessary to provide the Service, provide support, maintain security or comply with the law; and (b) are subject to appropriate contractual or statutory confidentiality obligations that survive the end of their relationship with SMTM.

6.2. Support access to the Agency's account (including the view-as-User feature) shall be used only where necessary to address an Agency request, investigate an incident or maintain the Service; it shall be logged, and actions taken shall be identified as performed by AgentsPayouts support.

7. Security

7.1. Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, as well as the risks to individuals' rights, SMTM shall implement and maintain reasonable and appropriate technical and organizational measures to protect Agency Personal Data, including, at a minimum, those described in Annex II.

7.2. SMTM may update such measures provided that the update does not materially reduce the overall level of protection.

7.3. The Agency acknowledges that it is responsible for the security measures under its control, including safeguarding its Users' credentials, using two-factor authentication where available, the security of the devices used to access the Service, and the protection of data it exports or downloads from the platform.

7.4. No security measure is infallible. SMTM does not guarantee that no incident will ever occur, without prejudice to its obligations under this Agreement and Data Protection Law.

8. Personal Data Breaches

8.1. Notification. SMTM shall notify the Agency without undue delay after becoming aware of a Personal Data Breach and, in any event, shall endeavor to do so within forty-eight (48) hours.

8.2. Content. The notification shall include, to the extent available at that time: (a) the nature of the breach, including, where possible, the categories and approximate number of Data Subjects and records concerned; (b) a point of contact; (c) the likely consequences; and (d) the measures taken or proposed to address the breach and mitigate its effects. Information may be provided in phases without further undue delay.

8.3. Channel. Notification shall be sent to the email address of the Agency's administrator or contact recorded in its account. The Agency is responsible for keeping that contact up to date. The Agency and its Users may report actual or suspected incidents to SMTM at [email protected].

8.4. Cooperation. SMTM shall take reasonable steps to contain, investigate and mitigate the breach, and shall reasonably cooperate with the Agency so that it can meet its obligations to notify authorities and Data Subjects.

8.5. No admission of liability. Notification of a breach does not, in itself, constitute an acknowledgment of fault or liability by SMTM.

8.6. Communications to third parties. Unless required by law, SMTM shall not notify Data Subjects or Supervisory Authorities directly regarding Agency Personal Data without first consulting the Agency, which, as Controller, decides on such notifications.

8.7. Incidents caused by the Agency or its Users (for example, shared or compromised credentials) shall not be deemed breaches by SMTM, without prejudice to the reasonable cooperation SMTM provides.

9. Data Subject Rights

9.1. Taking into account the nature of the processing, SMTM shall assist the Agency through appropriate technical and organizational measures, insofar as possible, in responding to requests to exercise Data Subject rights (access, rectification, erasure, objection, restriction, portability and equivalents).

9.2. The Service's features allow the Agency to view, correct, export and delete its End Clients' data. Where the Agency cannot address a request through those means, it may request assistance at [email protected].

9.3. If SMTM receives a request directly from a Data Subject concerning Agency Personal Data, it shall forward it to the Agency without undue delay where it can identify the Agency, and shall not respond directly except to direct the Data Subject to the Agency, or unless required by law or authorized by the Agency.

9.4. Assistance that exceeds what is reasonable or that cannot be provided through the Service's features may be subject to a reasonable fee agreed in advance.

10. Data Protection Impact Assessments and Prior Consultations

Upon the Agency's request, and taking into account the nature of the processing and the information available, SMTM shall provide the Agency with reasonable assistance in carrying out data protection impact assessments and, where applicable, prior consultations with Supervisory Authorities, to the extent the Agency does not otherwise have access to the necessary information (for example, through this Agreement, its Annexes or the Service documentation).

11. Sub-processors

11.1. General authorization. The Agency grants SMTM a general authorization to engage Sub-processors. The list of Sub-processors in effect at the date of this Agreement is set out in Annex III and will be kept up to date at section 4 of the Privacy Policy (https://www.agentspayouts.com/en/privacy).

11.2. Obligations. SMTM shall enter into a written agreement with each Sub-processor imposing data protection obligations substantially equivalent to those in this Agreement, to the extent applicable to the nature of the service provided. SMTM shall remain liable to the Agency for its Sub-processors' performance of their obligations under this Agreement.

11.3. Notice of changes. SMTM shall inform the Agency of any intended addition or replacement of Sub-processors at least fifteen (15) days in advance, by updating the page referred to above and by email or in-platform notice to the Agency's administrators.

11.4. Right to object. The Agency may object to a new Sub-processor on reasonable data protection grounds by notifying [email protected] in writing within the notice period. The Parties shall seek a solution in good faith. If none is possible, the Agency may terminate the affected Service by written notice and shall be entitled to a refund of prepaid fees for the unused period following termination.

11.5. Emergencies. Where a Sub-processor must be replaced urgently for security or Service continuity reasons, SMTM may do so and shall inform the Agency as soon as possible, and the Agency shall retain its right to object.

12. International Transfers

12.1. Location. SMTM is a United States company, and Agency Personal Data is processed primarily on infrastructure located in the United States, as well as in the Sub-processor locations set out in Annex III.

12.2. Safeguards. SMTM shall only make or permit international transfers of Agency Personal Data in accordance with applicable Data Protection Law.

12.3. Transfers from the EEA. To the extent that the Agency is subject to the GDPR with respect to Agency Personal Data and such data is transferred to SMTM in a country without an adequacy decision (and SMTM is not certified under the EU-U.S. Data Privacy Framework for that transfer), the Parties agree that the EU SCCs, Module Two (Controller to Processor), are incorporated by reference into this Agreement and are deemed entered into between the Agency, as data exporter, and SMTM, as data importer, with the selections set out in Annex IV.

12.4. Transfers from the United Kingdom. To the extent the UK GDPR applies, the EU SCCs are supplemented by the UK Addendum in accordance with Annex V.

12.5. Transfers from Switzerland. To the extent the Swiss FADP applies, the EU SCCs apply with the adaptations set out in Annex IV, paragraph 4.

12.6. Other jurisdictions. Where other law applicable to the Agency requires a specific transfer instrument (for example, model clauses issued by a Latin American authority), the Parties shall cooperate in good faith to execute it.

12.7. Precedence. In the event of conflict between this Agreement and the EU SCCs or the UK Addendum, the latter shall prevail with respect to the transfers they govern.

12.8. Onward transfers. SMTM may transfer Agency Personal Data to Sub-processors located outside the country of origin provided that Sections 11 and 12 are complied with.

13. Return and Deletion

13.1. Export. While the Terms are in force, the Agency may export its data using the Service's features. After termination, SMTM shall keep export available or, at the Agency's request, provide a copy of Agency Personal Data in a commonly used format, for a period of thirty (30) days (the "Return Period").

13.2. Deletion. After the Return Period, SMTM shall delete or anonymize Agency Personal Data from its active systems within the following thirty (30) days, unless applicable law requires its retention.

13.3. Backups. Agency Personal Data contained in backups shall be deleted in accordance with the ordinary rotation cycles of such backups, within a maximum of ninety (90) days from deletion from active systems. While it remains in backups, it shall remain protected under this Agreement and shall not be actively processed except to restore the Service.

13.4. Retention by legal obligation or by SMTM. SMTM may retain (a) data for which it acts as an independent controller under Section 2.3; and (b) Agency Personal Data that it must retain by law or for the establishment, exercise or defense of legal claims, in which case it shall limit its processing to those purposes and this Agreement shall continue to apply for as long as it is retained.

13.5. Certification. Upon the Agency's written request, SMTM shall confirm deletion in writing.

13.6. Deletion during the term. Data that the Agency or its Users delete in the Service during the term shall be deleted from active systems immediately or within a reasonable period and from backups in accordance with Section 13.3.

14. Information and Audits

14.1. Upon reasonable request, SMTM shall make available to the Agency the information necessary to demonstrate compliance with the obligations set out in this Agreement and in Article 28 of the GDPR or equivalent obligations, including this Agreement, its Annexes, a description of its security measures, reasonable responses to security questionnaires and, where available, its Sub-processors' certification or audit reports.

14.2. If the foregoing information is insufficient to demonstrate compliance, or if a Supervisory Authority so requires, the Agency may carry out, itself or through an independent auditor bound by confidentiality and not a competitor of SMTM, a reasonable audit, subject to the following conditions: (a) written notice at least thirty (30) days in advance, except in the case of an authority's request or a Personal Data Breach; (b) no more than once every twelve (12) months, except in the foregoing cases; (c) during business hours, without disproportionately affecting SMTM's operations or the security or confidentiality of other customers; (d) limited to systems and records relevant to the processing of Agency Personal Data; and (e) at the Agency's expense, unless the audit reveals a material breach by SMTM.

14.3. Audits of Sub-processors' facilities shall be governed by the audit rights those Sub-processors grant to SMTM, and SMTM may satisfy them through the reports such Sub-processors make available.

14.4. Audit results shall be SMTM's confidential information.

15. Liability

15.1. Each Party's liability arising out of or relating to this Agreement is governed by the limitations and exclusions of liability in the Terms, to the fullest extent permitted by applicable law.

15.2. Nothing in this Agreement limits (a) Data Subjects' rights under the EU SCCs or Data Protection Law where such rights cannot be limited by contract; or (b) liability that cannot be limited or excluded under applicable law.

16. Cooperation with Authorities

Each Party shall reasonably cooperate with the other with respect to requests or investigations by Supervisory Authorities concerning the processing covered by this Agreement. If SMTM receives a legally binding request from a public authority for access to Agency Personal Data, it shall notify the Agency, unless prohibited by law, and shall endeavor to limit disclosure to what is strictly required.

17. United States State Privacy Laws

To the extent the processing is subject to the CCPA or other United States state privacy laws, the terms of Annex VI shall also apply.

18. Order of Precedence

In the event of conflict or inconsistency, the following order of precedence applies: (1) the EU SCCs and the UK Addendum, where applicable and only with respect to the transfers they govern; (2) this Agreement and its Annexes; (3) the Terms; and (4) the Privacy Policy. The Privacy Policy is an informational notice and does not modify the Parties' contractual obligations regarding Agency Personal Data.

19. Governing Law and Jurisdiction

19.1. This Agreement is governed by the laws of the State of Florida, United States, and any dispute shall be submitted to the courts specified in the Terms, unless Data Protection Law, the EU SCCs or the UK Addendum require a different law or forum, in which case they shall prevail to the extent so required.

19.2. The EU SCCs are governed by the law and forum set out in Annex IV, and the UK Addendum by those set out in Annex V.

20. Acceptance, Amendments and General Provisions

20.1. Acceptance by an authorized representative. This Agreement is accepted electronically, once per Agency, by a person who represents that they have authority to legally bind the Agency. By accepting, that person states: "I represent that I have authority to legally bind (Agency name) and I accept the Terms and Conditions of Use and the Data Processing Agreement on its behalf." A person who does not have such authority must not accept.

20.2. Record. SMTM shall keep evidence of acceptance (User, Agency, role, document version identifier, immutable copy or hash of the text, language, UTC date and time, IP address, user agent and the authority statement), and shall make the accepted version available to the Agency for download or retention.

20.3. Existing Agencies. This Agreement also applies to Agencies that subscribed to the Service before its publication, from the time of their acceptance.

20.4. Amendments. SMTM may amend this Agreement (a) to comply with changes in Data Protection Law or requirements of authorities; (b) to reflect changes in the Service or in Sub-processors in accordance with Section 11; or (c) for other reasons, provided they do not materially reduce the protection of Agency Personal Data. Material amendments shall be notified at least thirty (30) days in advance and shall require new acceptance by an authorized representative where applicable. Amendments shall not affect the incorporated EU SCCs, except to reflect successor versions approved by the competent authority.

20.5. Severability. If any provision is held invalid, the remaining provisions shall remain in effect and the invalid provision shall be construed in the valid manner closest to the Parties' intent.

20.6. Notices. Notices to SMTM shall be sent to [email protected] (data protection and Data Subject rights), [email protected] (incidents) or SMTM's address stated at the beginning of this Agreement.

ANNEX I — DESCRIPTION OF THE PROCESSING

A. Parties

• Controller / data exporter: the Agency identified in the AgentsPayouts account. Contact: the administrator registered in the account. Activities: use of the Service to manage its travel agency business. Role: Controller.
• Processor / data importer: SMTM LAB LLC, 9826 Introduction Way, Orlando, FL 32832, USA. Contact: [email protected]. Activities: provision of the AgentsPayouts Service. Role: Processor.

B. Categories of Data Subjects

1. The Agency's End Clients (travelers, clients and prospective clients).

2. End Clients' companions and family group members, who may include minors.

3. Leads or interested persons recorded by the Agency.

4. Agency Users (administrators and agents), to the extent their data appears in the Agency's business records (for example, as the agent assigned to a sale, in commission settlements or in reports). Users' account data is processed by SMTM as an independent controller under Section 2.3.

5. Contact persons at travel suppliers recorded by the Agency, if any.

C. Categories of Personal Data

1. End Client identification and contact data: first and last name, email address, telephone number, date of birth, notes or comments entered by the Agency.

2. Family group and companions: name, relationship and, optionally, date of birth.

3. Travel documentation: only the passport expiration date of the End Client and their companions. The Service does not request, and is not designed to store, passport or other identity document numbers.

4. Travel preferences and indicators: preferences and indicators selected by the Agency or derived from recorded bookings, such as frequent suppliers, products, trip types, airlines or travel months, including what the End Client prefers or avoids, selected from the Agency's supplier catalogue or a predefined list. These fields may not be used to record medical, religious or other sensitive information.

5. Booking and sales data: supplier, product or unit, booking or confirmation numbers, booking and travel dates, destination, sale amounts, commissions and related data, sale status and attachments (for example, PDF receipts or vouchers).

6. Proposals: content of proposals or quotes prepared for End Clients, including those shared by link.

7. Leads: name, contact details, travel interest and notes.

8. Reminders and tasks: content of reminders associated with End Clients or bookings.

9. Marketing communication consents (future feature): record of the existence, date and scope of the End Client's consent to receive communications from the Agency.

10. User data within business records: agent name, commissions and settlements associated with their sales.

D. Sensitive data or special categories

The Service is not designed to process special categories of data or sensitive data, and the Agency undertakes not to enter them (Section 5.1.d). Minors' data: the Service may process limited data of minors (name, relationship and, optionally, date of birth and passport expiration date) included in bookings entered by the Agency, in accordance with Section 5.1.c. Restrictions and safeguards applied: those in Annex II.

E. Frequency of the transfer

Continuous, for as long as the Agency uses the Service.

F. Nature of the processing

Hosting, storage, organization, retrieval, calculation (commissions and metrics), display, generation of reports and documents, sending of transactional emails and push notifications, backups, technical support and deletion.

G. Purpose

To provide the Service to the Agency in accordance with the Terms: management of sales, bookings, commissions and agent settlements; management of clients, companions, preferences, proposals, leads and reminders; reporting; notifications; support; security and continuity of the Service.

H. Retention period

For the term of the Terms, subject to the Agency's configuration and deletions, and thereafter in accordance with Section 13.

I. Transfers to Sub-processors

As set out in Annex III, with the subject matter, nature and duration indicated there.

ANNEX II — TECHNICAL AND ORGANIZATIONAL MEASURES

The following measures describe the state of the Service as of the date of this Agreement.

1. Encryption

• Encryption in transit via TLS for access to the web application, the mobile application and APIs.
• Encryption at rest provided by the hosting provider's database and storage infrastructure.
• Logical backups that SMTM keeps outside the provider's infrastructure are encrypted before storage.

2. Access control and isolation between Agencies

• Multi-tenant architecture with per-Agency isolation enforced in the database through row-level security (RLS) policies.
• Role-based access control (agent, administrator, platform superadministrator) enforced on the server.
• Elevated-privilege credentials (for example, database service keys) are used only server-side and are not exposed to browsers or the mobile application; where used, additional Agency-membership checks are applied.
• Two-factor authentication (TOTP) available.
• Bot protection (CAPTCHA) on sign-in and public forms, when enabled.
• Session management with authentication cookies and handling of invalid or expired sessions.

3. Minimization by design

• The Service has no fields for passport numbers, identity document numbers, Social Security numbers or full payment card data.
• Subscription payment card data is received directly by the payment processor and does not pass through SMTM's servers.
• Error monitoring is configured not to send personal data by default, and on-error session recordings mask text and block media elements.

4. Logging and traceability

• Audit logs of relevant actions within the Service.
• Support access to customer accounts is logged, and changes made are identified as performed by AgentsPayouts support.

5. Availability, backups and recovery

• Automatic backups provided by the database provider.
• Additional daily encrypted logical backups, with verification and monitoring alerts.
• Uptime monitoring and alerting.

6. Secure development and operations

• Version control and change review; automated deployments to a staging environment before production.
• Versioned database migrations and automated checks before each deployment.
• Dependency management with periodic review of known vulnerabilities.
• Separation of staging and production environments.
• Perimeter protection, DNS and attack mitigation through the network provider.

7. Organizational measures

• Personnel access limited to what is necessary and subject to confidentiality obligations.
• Incident response procedure with reporting channels ([email protected]) and notification in accordance with Section 8.
• Selection of Sub-processors with recognized security practices and data processing agreements.
• Usage and Confidentiality Policy individually accepted by every person with access to the platform.

8. Measures for which the Agency is responsible

• Managing User onboarding and offboarding, safeguarding credentials, using two-factor authentication where available, and securing devices and exported data.

ANNEX III — SUB-PROCESSORS

List in effect as of the date of this version of the Agreement.

A. Sub-processors that process Agency Personal Data

B. Providers for which SMTM acts as an independent controller (for information)

They do not process Agency Personal Data; listed for transparency:

ANNEX IV — EU STANDARD CONTRACTUAL CLAUSES (SELECTIONS)

Applicable only where required under Section 12.3.

1. Module: Module Two (Controller to Processor).

2. Selections:

• Clause 7 (docking clause): included.
• Clause 9(a) (sub-processors): Option 2, general written authorization, with the prior notice period set out in Section 11.3 of this Agreement.
• Clause 11(a) (redress): the optional independent dispute resolution body is not included.
• Clause 13 (supervision): the competent Supervisory Authority shall be that of the Member State in which the data exporter is established or, where the exporter is not established in the EU and has appointed a representative under Article 27(1) GDPR, that of the Member State in which such representative is established; otherwise, that of the Member State in which the Data Subjects whose data is transferred are located.
• Clause 17 (governing law): Option 2, the law of the Member State in which the data exporter is established; where such law does not allow for third-party beneficiary rights, the law of Ireland.
• Clause 18 (choice of forum): the courts of the Member State whose law applies under Clause 17.

3. SCC Annexes: Annex I.A and I.B of the SCCs are completed by Annex I of this Agreement; Annex I.C by paragraph 2 above (Clause 13); Annex II of the SCCs by Annex II of this Agreement; and Annex III of the SCCs by Annex III of this Agreement.

4. Switzerland: where the transfer is subject to the Swiss FADP: (a) the competent supervisory authority shall be the Federal Data Protection and Information Commissioner (FDPIC) with respect to such transfers; (b) references to the GDPR shall be understood as references to the Swiss FADP; (c) the term "Member State" shall not be interpreted so as to exclude Data Subjects habitually resident in Switzerland from bringing claims before the courts of their place of residence; and (d) the governing law and forum shall be those set out in paragraph 2, unless the Swiss FADP requires otherwise.

5. Supplementary measures:

ANNEX V — UNITED KINGDOM

Applicable where the transfer is subject to the UK GDPR.

1. The UK Addendum (version B1.0, in force from 21 March 2022, or any successor version) is incorporated by reference and deemed entered into between the Agency (exporter) and SMTM (importer).

2. Table 1 (Parties): as set out in Annex I.A of this Agreement.

3. Table 2 (Selected SCCs): the Approved EU SCCs, Module Two, with the selections in Annex IV.

4. Table 3 (Appendix Information): Annexes I, II and III of this Agreement.

5. Table 4 (Ending the Addendum when the Approved Addendum changes): both the importer and the exporter may end it.

6. Alternatively, if the Parties so agree in writing, the ICO's International Data Transfer Agreement (IDTA) may be used.

ANNEX VI — UNITED STATES STATE PRIVACY LAWS

Applicable to the extent the processing of Agency Personal Data is subject to the CCPA or other United States state privacy laws.

1. California (CCPA/CPRA). Where the Agency is a "business" and SMTM a "service provider" under the CCPA, SMTM shall:

a) process personal information only for the limited and specified business purposes set out in Annex I (provision of the Service);

b) not sell or share personal information;

c) not retain, use or disclose personal information (i) for any purpose other than those specified in this Agreement, including any commercial purpose of its own, or (ii) outside the direct business relationship between SMTM and the Agency, except as permitted by the CCPA;

d) not combine personal information received from the Agency with personal information received from other sources or collected from its own interaction with consumers, except as permitted by the CCPA;

e) comply with applicable CCPA obligations and provide the same level of privacy protection as the CCPA requires;

f) notify the Agency if it determines that it can no longer meet its obligations under the CCPA;

g) acknowledge the Agency's right to take reasonable and appropriate steps to ensure that SMTM uses personal information in a manner consistent with the Agency's obligations and, upon notice, to stop and remediate unauthorized use; and

h) impose equivalent obligations on its Sub-processors.

SMTM certifies that it understands and will comply with the restrictions in this paragraph.

2. Other state laws with a controller/processor framework (for example, Virginia, Colorado, Connecticut, Utah, Texas, Oregon and others adopting a similar framework). Where applicable, SMTM shall: a) process data in accordance with the Agency's instructions; b) ensure that each person processing the data is subject to a duty of confidentiality; c) delete or return the data at the end of the Service, unless retention is required by law; d) make available to the Agency the information necessary to demonstrate compliance; e) allow reasonable assessments in accordance with Section 14 or provide an independent assessment report; and f) engage Sub-processors under a written contract with equivalent obligations and give the Agency an opportunity to object in accordance with Section 11.

3. Florida.

a) Florida Information Protection Act (Fla. Stat. § 501.171): as a third-party agent processing information on behalf of the Agency, SMTM shall notify the Agency of security breaches in accordance with Section 8, and in any event within the maximum period provided by that statute, and shall provide the information reasonably necessary for the Agency to meet its own notification obligations.

b) Florida Digital Bill of Rights (Fla. Stat. § 501.701 et seq.): to the extent the Agency is a "controller" subject to that law, SMTM shall comply with the "processor" obligations set out therein, which are deemed covered by Sections 4, 6, 7, 9, 11, 13 and 14 of this Agreement.