Data Processing Addendum

This Data Processing Addendum (the "DPA") applies only where it is expressly incorporated by reference in the agreement between Workbrew, Inc. ("Workbrew") and the counterparty under which Workbrew provides services (whether a Cloud Service Agreement, MSP Partner Agreement, Channel Partner Agreement, or other applicable agreement) (the "Agreement"), and supplements and is incorporated into such Agreement. References to "Customer" in this DPA mean the counterparty to the Agreement. By executing or otherwise accepting the Agreement (whether by signature, click-through acceptance, or use of the Services), Customer agrees to be bound by this DPA without the need for a separate signature. In the event of any inconsistency or conflict between this DPA and the Agreement with respect to the Processing of Customer Personal Data, the terms of this DPA will govern solely to the extent of such inconsistency or conflict.

This DPA sets out the terms that apply when Customer Personal Data is Processed by Workbrew under the Agreement. The purpose of the DPA is to ensure that such Processing is conducted in accordance with Data Protection Legislation and respects the rights of individuals whose Personal Data is Processed under the Agreement and applies to Workbrew and any of our affiliates involved in the Processing of Customer Personal Data.

1. DEFINITIONS

"Controller" means "Controller" or "Business" as those terms are defined by applicable Data Protection Legislation.

"Customer Personal Data" means Personal Data that: (a) is submitted to or generated within Customer's designated workspace(s) on the Workbrew platform (accessible at console.workbrew.com or such successor URL as Workbrew may designate); (b) is Processed by Workbrew solely in connection with providing the Services to Customer; and (c) relates to Customer's employees, contractors, or other individuals authorized by Customer to access the Services under Customer's account, or — where Customer acts as a Processor on behalf of its own customers — to individuals authorized by those customers to access the Services within a workspace administered by Customer (in each case, including associated device and operating system metadata) (each, a "User"). Customer Personal Data expressly excludes: (i) Personal Data that Workbrew collects for its own business purposes, including in connection with account management, billing, or product analytics that Workbrew performs as a Controller; (ii) Personal Data collected through workbrew.com or any other Workbrew marketing property; and (iii) Personal Data associated with individual user accounts that span multiple customers or workspaces to the extent such data is not associated with any workspace administered by Customer.

"Data Protection Legislation" means privacy and data protection laws and regulations applicable to Workbrew's Processing of Customer Personal Data in the provision of the Services to Customer, including, as applicable: (a) the GDPR; (b) any legislation which implements or supplements the GDPR; (c) any legislation which implements the European Community's Directive 2002/58/EC; (d) in respect of the United Kingdom, the Data Protection Act 2018 and the EU GDPR as saved into United Kingdom law by virtue of Section 3 of the United Kingdom's European Union (Withdrawal) Act 2018; and/or (e) U.S. Privacy Laws; in each case, as may be amended, superseded, or replaced from time to time.

"Data Subject" means an individual to whom Customer Personal Data relates.

"GDPR" means the General Data Protection Regulation (EU) 2016/679 on the protection of natural persons with regard to the Processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, and any amendment or replacement to it.

"Personal Data" means any data or information that constitutes "personal data," "personal information," or any analogous term as defined by applicable Data Protection Legislation.

"Process," "Processing," and "Processed" have the meaning as defined by applicable Data Protection Legislation or, if not defined by applicable Data Protection Legislation, mean collect, hold, use, disclose, process, store, transfer, access, correct, deal with or handle.

"Processor" means "Processor," "Service Provider," or "Contractor" as those terms are defined by applicable Data Protection Legislation.

"Sale" and "Selling" have the meaning defined in applicable U.S. Privacy Laws.

"Security Incident" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data transmitted, stored or otherwise Processed.

"Services" means the enterprise software delivery and package management platform made available by Workbrew to Customer at console.workbrew.com (and any successor URLs or related APIs, integrations, or connected products), as further described in the Agreement. The Services expressly exclude Workbrew's marketing properties (including workbrew.com) and any communications or data collection occurring outside of Customer's authenticated workspace.

"Standard Contractual Clauses" or "SCCs" means the clauses annexed to the EU Commission Implementing Decision 2021/914 of June 4, 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council as amended or replaced from time to time, available at: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32021D0914&from=EN.

"Supervisory Authority" will have the meaning ascribed to it in the GDPR.

"UK Addendum" means the addendum to the SCCs issued by the UK Information Commissioner under Section 119A(1) of the UK Data Protection Act 2018 (version B1.0, in force March 21, 2022).

"U.S. Privacy Laws" means U.S. privacy and data protection laws and regulations applicable to Workbrew's Processing of Customer Personal Data in the provision of the Services to Customer.

The terms "Business," "Share," and "Service Provider" as used in this DPA will have the meanings ascribed to them in the California Consumer Privacy Act, Cal. Civ. Code §1798.100 et seq., as amended by the California Privacy Rights Act, and its implementing regulations ("CCPA").

All capitalized terms not defined in this DPA will have the meaning given to them in the Agreement.

2. PROCESSING OF DATA

2.1 Scope and Purpose of Processing. This DPA applies only where and to the extent Data Protection Legislation governs Workbrew's Processing of Customer Personal Data on behalf of Customer in the course of providing the Services pursuant to the Agreement, including Workbrew's Processing of Customer Personal Data for the nature, purposes, and duration set forth in Appendix I. Workbrew will not collect, use, disclose, release, disseminate, transfer, or otherwise communicate or make available to a third-party Customer Personal Data except to provide the Services or as expressly permitted by the Agreement or this DPA.

2.2 Processor and Controller Responsibilities. The parties acknowledge and agree that as between the parties: (a) Workbrew is the Processor of Customer Personal Data under the Data Protection Legislation; (b) Customer is the Controller of Customer Personal Data under the Data Protection Legislation or, where Section 2.3 applies, a Processor acting on the documented instructions of the relevant Controller; and (c) each party will comply with the obligations applicable to it under the Data Protection Legislation regarding the Processing of Customer Personal Data.

2.3 Authorization by Third-Party Controller. If Customer is a Processor acting on behalf of a third-party Controller, Customer represents and warrants to Workbrew that: (a) Customer's instructions and actions with respect to Customer Personal Data, including its appointment of Workbrew as a further Processor, have been duly authorized by the relevant Controller in accordance with applicable Data Protection Legislation; (b) the relevant Controller's processing instructions are consistent with the Agreement and this DPA; and (c) Customer will provide Workbrew with evidence of such authorization promptly upon request.

2.4 Customer Instructions. Customer instructs Workbrew to Process Customer Personal Data: (a) for all activities described in the Agreement, this DPA (including Appendix 1), or any applicable Order, or otherwise required by Customer's use of the Services pursuant thereto; and (b) to comply with other reasonable instructions provided by Customer or a User where such instructions are consistent with the Agreement. Customer will ensure that its instructions for the Processing of Customer Personal Data comply with the Data Protection Legislation. Customer has sole responsibility for the accuracy, quality, and legality of Customer Personal Data and the means by which Customer obtained the Customer Personal Data. Customer will disclose Customer Personal Data to Workbrew solely pursuant to a valid business purpose. Customer will ensure that, if required under the Data Protection Legislation, Data Subjects are notified of and give their consent to Workbrew's Processing of Customer Personal Data.

2.5 Workbrew's Compliance with Customer Instructions. Workbrew will only Process Customer Personal Data in accordance with Customer's instructions and will treat Customer Personal Data as Confidential Information. Workbrew may Process Customer Personal Data other than on the written instructions of Customer if it is required under applicable law to which Workbrew is subject. In this situation, Workbrew will inform Customer of such requirement before Workbrew Processes the Customer Personal Data unless prohibited by applicable law. Workbrew will immediately inform Customer if, in Workbrew's opinion, Customer's instructions infringe Data Protection Legislation. Workbrew may suspend such Processing until Customer modifies the instruction to resolve the non-compliance.

2.6 Assistance with Customer's Obligations. Workbrew provides Customer the ability to access, correct, amend or delete Customer Personal Data contained in the Services. Workbrew will promptly comply with reasonable requests by Customer to assist with such actions to the extent Workbrew is legally permitted and able to do so. Workbrew may charge a reasonable fee for any assistance not strictly required by Data Protection Legislation.

2.7 Notification Obligations. Workbrew will, to the extent legally permitted, promptly notify Customer if it receives a request from a Data Subject for access to, correction, amendment, deletion of or objection to the Processing of Customer Personal Data relating to such individual. Workbrew will forward such Data Subject requests relating to Customer Personal Data to Customer and Customer will be responsible for responding to any such request using the functionality of Services. Workbrew will provide Customer with commercially reasonable cooperation and assistance in relation to handling of a Data Subject request, to the extent legally permitted and to the extent Customer does not have access to such Customer Personal Data through its use or receipt of the Services. Workbrew will not be liable in cases where Customer fails to respond to the Data Subject's request completely, correctly, or in a timely manner. Notwithstanding the foregoing, nothing in this Section 2.7 will restrict Workbrew from responding to a request from a Data Subject where it is required to do so under the Data Protection Legislation.

2.8 General Authorization for Subprocessors. Customer generally authorizes the use of subprocessors to process Customer Personal Data in connection with fulfilling Workbrew's obligations under the Agreement and/or this DPA and explicitly approves the list of subprocessors located at https://trust.workbrew.com/subprocessors, as may be updated from time to time in accordance with Section 2.9.

2.9 New Subprocessors. Workbrew will notify Customer of any new subprocessor engaged to Process Customer Personal Data by updating its list of subprocessors located at https://trust.workbrew.com/subprocessors. Customer may sign up on the website to receive notifications of changes to the subprocessor list. If Customer has a good-faith objection to Workbrew's use of a new subprocessor based on reasonable data protection concerns, Customer shall notify Workbrew in writing within ten (10) days after Workbrew updates the subprocessor list. The parties will discuss Customer's concerns in good faith; provided, however, that if the parties are unable to resolve Customer's objection within thirty (30) days after Workbrew's receipt of Customer's objection notice, Customer may, as its sole and exclusive remedy, terminate the applicable Order(s) or Statement(s) of Work affected by the new subprocessor upon written notice to Workbrew.

2.10 Workbrew Obligations. Workbrew will remain liable for the acts and omissions of its subprocessors to the same extent Workbrew would be liable if performing the services of each subprocessor directly. Workbrew will contractually impose data protection obligations on its subprocessors that are at least equivalent to those data protection obligations imposed on Workbrew under this DPA.

2.11 Audit Rights. Upon Customer's written request to privacy@workbrew.com no more than once per year, Workbrew will provide a copy of its then most recent third-party audits or certifications, as applicable, or any summaries thereof, such that Customer may reasonably verify Workbrew's compliance with the technical and organizational measures required under this DPA. Where required by the applicable Data Protection Legislation, Workbrew will allow Customer, or a mutually agreed upon independent auditor appointed by Customer, to conduct an audit (including inspection), no more than once per year upon eight weeks' notice sent to privacy@workbrew.com complete with a detailed audit plan describing the proposed scope, duration, and start date of the audit. Workbrew will contribute to such audits whose sole purpose will be to verify Workbrew's compliance with its obligations under this DPA. The auditor must execute a written confidentiality agreement acceptable to Workbrew before conducting the audit. The audit must be conducted during Workbrew's normal business hours, subject to Workbrew's policies, and may not unreasonably interfere with Workbrew's business activities. Any audits are at Customer's sole cost and expense. Customer will promptly notify Workbrew with information regarding any non-compliance discovered during the course of an audit.

2.12 Limits on Auditing Party. Nothing in this DPA will require Workbrew to disclose to an independent auditor or Customer, or to allow an independent auditor or Customer to access: (a) any data of any other user or customer of Workbrew; (b) Workbrew's internal accounting or financial information; (c) any trade secret of Workbrew; (d) any premises or equipment not controlled by Workbrew; or (e) any information that, in Workbrew's reasonable opinion, could: (i) compromise the security of Workbrew's systems or premises; (ii) cause Workbrew to breach its obligations under Data Protection Legislation or the rights of any third-party; or (iii) any information that an independent auditor seeks to access for any reason other than the good faith fulfillment of Customer's rights under the Data Protection Legislation. Customer will contractually impose, and designate Workbrew as a third-party beneficiary of, any contractual terms that prohibit any independent auditor from disclosing the existence, nature, or results of any audit to any party other than Customer unless such disclosure is required by applicable law.

2.13 Third Party Data Sources. Customer acknowledges that Workbrew obtains certain Personal Data from third-party providers for the purpose of providing the Services. Workbrew warrants that: (a) such data is obtained from providers who represent that they have lawful rights to provide the data; (b) Workbrew will process such data only for Customer's legitimate business purposes; and (c) Workbrew will implement appropriate safeguards for data obtained from external sources. Customer is responsible for ensuring its use of such third-party sourced data complies with applicable Data Protection Legislation.

2.14 Aggregated and De-Identified Data. Notwithstanding anything to the contrary in this DPA, Workbrew may aggregate, anonymize, and de-identify Customer Personal Data such that it cannot reasonably be used to identify any individual or Customer (collectively, "Aggregated Data"). Workbrew may use Aggregated Data for its own legitimate business purposes, including product improvement, security research, and platform analytics, provided that: (a) Aggregated Data is not disclosed to third parties in a form that identifies Customer; and (b) Workbrew implements appropriate technical measures to prevent re-identification.

3. GDPR

3.1 Applicability. Section 3 only applies to Workbrew's Processing of Customer Personal Data subject to GDPR.

3.2 Data Privacy Impact Assessments. Workbrew will take reasonable measures to cooperate and assist Customer in conducting a data protection impact assessment and related consultations with any Supervisory Authority, if Customer is required to do so under Data Protection Legislation.

3.3 International Transfers. The parties will transfer Customer Personal Data internationally only pursuant to a transfer mechanism valid under the Data Protection Legislation or applicable law, i.e. a valid mechanism in the exporting country to ensure an adequate level of protection, or within a permitted derogation. For example, if Customer contracts for Services with Workbrew, and when utilized subject to Section 3.4, the SCCs shall apply to Workbrew in its role as the "data importer" and to Customer in its role as the "data exporter." Upon request, Workbrew will provide information related to the transfer mechanism utilized, which may include a copy of applicable SCCs entered into with a data importer. Where Customer acts as a Controller, Module Two (Controller-to-Processor) of the SCCs applies; where Customer acts as a Processor under Section 2.3, Module Three (Processor-to-Processor) applies.

3.4 Transfer Mechanism. In the event there is more than one mechanism to transfer Customer Personal Data from the European Economic Area, United Kingdom, and/or Switzerland to countries which do not ensure an adequate level of data protection under the Data Protection Legislation, the transfer of Customer Personal Data will be subject to a single transfer mechanism applicable to the entity providing the Services through a valid transfer mechanism approved for transfers of Customer Personal Data from the European Economic Area, United Kingdom, or Switzerland to the U.S., such as the SCCs and/or the UK Addendum (as applicable).

3.5 Changes to Transfer Mechanism. If Workbrew's compliance with Data Protection Legislation applicable to international data transfers is affected by circumstances outside of Workbrew's control, including if a legal instrument for international data transfers is invalidated, amended, or replaced, then Customer and Workbrew will work together in good faith to reasonably resolve such non-compliance. In the event that additional, replacement or alternative transfer mechanisms, standard contractual clauses or UK standard contractual clauses are approved by Supervisory Authorities, Workbrew reserves the right to choose the transfer mechanism of its preference, and amend the Agreement and this DPA by adding to or replacing, the existing transfer mechanism; provided that Workbrew will ensure continued compliance with Data Protection Legislation.

3.6 Applicability of the Standard Contractual Clauses. When utilized, the SCCs and the UK Addendum concluded between the parties pursuant to this Section 3 will only apply insofar as strictly necessary for Workbrew to comply with the applicable Data Protection Legislation.

4. U.S. PRIVACY LAWS

4.1 Applicability. Section 4 only applies to Workbrew's Processing of Customer Personal Data subject to U.S. Privacy Laws.

4.2 Compliance Assurance. If the provision of information provided pursuant to Section 2.12 above does not fulfil the requirements of the applicable U.S. Privacy Laws, Customer has the right to take reasonable and appropriate steps to ensure that Workbrew uses Customer Personal Data consistent with Customer's obligations under applicable U.S. Privacy Laws.

4.3 Compliance Remediation. Workbrew shall promptly notify Customer after determining that it can no longer meet its obligations under applicable U.S. Privacy Laws. Upon receiving notice from Workbrew in accordance with this section, Customer may direct Workbrew to take reasonable and appropriate steps to stop and remediate unauthorized use of Customer Personal Data.

4.4 Limitations on Processing. Workbrew will Process Customer Personal Data solely as described in the Agreement, this DPA (including Appendix 1) and any applicable Order. Except as expressly permitted therein or by the U.S. Privacy Laws, Workbrew is prohibited from (a) Selling or Sharing Customer Personal Data, (b) retaining, using, or disclosing Customer Personal Data for any other purpose, (c) retaining, using, or disclosing Customer Personal Data outside of the direct business relationship between the parties, and (d) combining Customer Personal Data with Personal Data obtained from, or on behalf of, sources other than Customer or its Users, except as expressly permitted under applicable U.S. Privacy Laws.

4.5 Deletion Requests. Workbrew shall not be required to delete any Customer Personal Data to comply with a Data Subject's request directed by Customer if retaining such information is specifically permitted by applicable U.S. Privacy Laws; provided, however, that in such case, Workbrew will promptly inform Customer of the exceptions relied upon under applicable U.S. Privacy Laws and Workbrew shall not use Customer Personal Data retained for any purpose other than provided for by that exception.

4.6 Deidentified Data. In the event that Customer discloses or makes available deidentified data (as such term is defined in the U.S. Privacy Laws) to Workbrew, Workbrew shall not attempt to reidentify the information.

4.7 Sale of Data. The parties acknowledge and agree that the exchange of Personal Data between the parties does not form part of any monetary or other valuable consideration exchanged between the parties with respect to the Agreement or this DPA.

5. SECURITY

5.1 Workbrew Personnel. Workbrew will inform its personnel engaged in the Processing of Customer Personal Data of the confidential nature of the Customer Personal Data, and subject them to obligations of confidentiality that survive the termination of that individual's engagement with Workbrew.

5.2 Third Party Disclosure. Workbrew will not disclose Customer Personal Data to any third party unless authorized by Customer or required by law. If a government entity (including a law enforcement agency) or Supervisory Authority demands access to Customer Personal Data, Workbrew will attempt to redirect the requester to request the data directly from Customer or notify Customer prior to disclosure, in each case unless prohibited by law.

5.3 Security. Workbrew will implement commercially reasonable technical and organizational measures to safeguard Customer Personal Data, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of Processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons.

6. SECURITY BREACH

6.1 Notification Obligations. Upon becoming aware of any Security Incident affecting Customer Personal Data, the parties shall notify each other without undue delay and shall provide timely updates and information relating to the Security Incident as it becomes known or as is reasonably requested by the other party. Such information will include the nature of the Security Incident, the categories and number of Data Subjects affected, the categories and amount of Customer Personal Data affected, the likely consequences of the Security Incident, and the measures taken or proposed to be taken to address the Security Incident and mitigate possible adverse effects. Workbrew's obligations in this Section 6 do not apply to unsuccessful attempts or activities that do not compromise the security of Customer Personal Data, including unsuccessful log-in attempts, pings, port scans, denial of service attacks, and other network attacks on firewalls or networked systems. For avoidance of doubt, nothing in this Section 6 imposes on Workbrew any liability, investigation obligation, remediation obligation, or indemnification obligation with respect to a Security Incident to the extent caused by the acts or omissions of Customer or Users.

6.2 Manner of Notification. Notification(s) of Security Incidents, if any, will be delivered to one or more of Customer's business, technical or administrative contacts by any means Workbrew selects, including via email. It is Customer's sole responsibility to maintain accurate contact information on Workbrew's systems at all times. For the avoidance of doubt, the notification obligations in this Section 6 apply regardless of which party caused or contributed to the Security Incident, consistent with Article 33(2) of the GDPR and equivalent requirements under other Data Protection Legislation. Furthermore, it is Customer's sole responsibility to notify the relevant data protection Supervisory Authority and, when applicable, the Data Subjects of a Security Incident as required under the Article 33 and 34 of the GDPR or other Data Protection Legislation. Workbrew will promptly comply with reasonable requests by Customer to assist it with meeting such notification requirements to the extent Workbrew is legally permitted and able to do so. Notwithstanding the foregoing, nothing in this Section 6.2 will restrict Workbrew from notifying the relevant Supervisory Authority or Data Subjects of a Security Incident where it is required to do so under the Data Protection Legislation.

7. MISCELLANEOUS

7.1 Term of DPA. This DPA will remain in effect until, and automatically expire upon, deletion of all Customer Personal Data as described in this DPA.

7.2 Deletion of Customer Personal Data. Workbrew will delete Customer Personal Data in its possession in accordance with the Agreement, subject to its automated deletion schedule and back-up policy. Workbrew has no obligation to retain any portion of Customer Personal Data after such period except to the extent that Workbrew is required under applicable law to keep a copy of the Customer Personal Data.

7.3 Amendment. Except as otherwise provided in the Agreement (including any amendment-by-posting mechanism set forth therein), this DPA may not be modified or amended except by a written instrument executed by both parties. Notwithstanding the foregoing, Workbrew may update this DPA to the extent necessary to comply with changes in applicable Data Protection Legislation, provided that such updates do not materially diminish Customer's rights or Workbrew's obligations under this DPA.

7.4 Claims. Any claim or remedy Customer may have against Workbrew, its subsidiaries, employees, agents, or subprocessors, arising under or in connection with this DPA, whether in contract, tort (including negligence) or under any other theory of liability, shall be subject to the limitations and exclusions of liability in the Agreement to the maximum extent permitted by law. Accordingly, any reference in the Agreement to the liability of a party means the aggregate liability of that party under and in connection with the Agreement and this DPA together. This DPA shall be governed by and construed in accordance with the governing law and jurisdiction provisions in the Agreement, unless otherwise required by applicable Data Protection Legislation.

7.5 Severability. If any part of this DPA is held unenforceable, the validity of all remaining parts will not be affected.

APPENDIX I – ANNEX I TO THE STANDARD CONTRACTUAL CLAUSES

A. LIST OF PARTIES

Data exporter(s): Identity and contact details of the data exporter(s) and, where applicable, of its/their data protection officer and/or representative in the European Union

• Name: The Customer entity identified in the applicable Order Form, Statement of Work, or registration process.
• Address: As provided by Customer during account registration or as set forth in the applicable Order Form or Statement of Work.
• Contact person's name, position and contact details: As provided by Customer during account registration or contracting.
• Activities relevant to the data transferred under these Clauses: Workbrew provides the Services to Customer as described in the applicable Agreement.
• Role (controller/processor): Controller or, where Section 2.3 of the DPA applies, Processor (Customer Personal Data).
• Signature and date: Deemed executed as of the effective date of the Agreement incorporating this DPA.

Data importer(s): Identity and contact details of the data importer(s), including any contact person with responsibility for data protection

• Name: Workbrew, Inc.
• Address: 2810 N Church St, Suite 68294, Wilmington DE 19802.
• Contact person's name, position and contact details: Vanessa Gennarelli, COO – vanessa@workbrew.com.
• Activities: Processing Customer Personal Data for the purposes of providing the Services pursuant to the Agreement.
• Role (controller/processor): Processor (Customer Personal Data).

B. DESCRIPTION OF TRANSFER

The details below describe the scope and purpose of Customer Personal Data transfers under the Agreement.

1. Categories of data subjects whose personal data is transferred:

Users of the Workbrew Services, including Customer's employees, contractors, and other authorized individuals who access or use the Services.

2. Categories of personal data transferred:

• Name
• Contact information (e.g., email, phone number)
• IP address or other online identifiers
• Device and operating system metadata
• Other personal data submitted by or on behalf of Customer in its use of the Services

3. Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialized training), keeping a record of access to the data, restrictions for onward transfers or additional security measures:

N/A

4. The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis):

Continuous during the term of the Agreement.

5. Nature of the Processing:

Processing of Customer Personal Data to provide, support, secure, and improve the Services, including storage, access, transmission, and analysis in accordance with the Agreement.

6. Purpose(s) of the data transfer and further Processing:

To perform Workbrew's obligations under the Agreement, including providing the Services and related support.

7. The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period:

Customer Personal Data is retained for the duration specified in the Agreement, subject to Workbrew's standard backup and deletion schedules. Data will be deleted or de-identified thereafter unless retention is required by applicable law.

8. For transfers to (sub-) processors, also specify subject matter, nature and duration of the Processing:

Workbrew's subprocessors provide infrastructure, hosting, and ancillary support services necessary to provide the Services. Details are available at: https://trust.workbrew.com/subprocessors. Subprocessor processing is limited to what is strictly necessary to support Workbrew's performance under the Agreement and is subject to contractual data protection obligations.

C. COMPETENT SUPERVISORY AUTHORITY

For the purposes of Clause 13 of the Standard Contractual Clauses:

Where the GDPR applies: The competent Supervisory Authority shall be the authority in the EEA Member State where the data exporter is established. If the data exporter is not established in the EEA but falls within the territorial scope of the GDPR under Article 3(2), the competent authority shall be the authority of the Member State where the data exporter's EU representative is located, as identified in the Agreement or Order Form.

Where the UK GDPR applies: The competent authority shall be the UK Information Commissioner.

Where the Swiss FADP applies: The competent authority shall be the Swiss Federal Data Protection and Information Commissioner (FDPIC), to the extent applicable.