Data Processing Addendum

Version v2.8, 13 October 2026 — in force from 13 October 2026.

Parties

1. DMND Holdings Pty Ltd (ACN 657 968 860, ABN 68 657 968 860), trading as Get Hands Group, of 8/26 Davison Street, Richmond VIC 3121, Australia (the Supplier); and

2. the client named when the terms are accepted (Registration number as recorded on acceptance) of as recorded on acceptance (the Client).

Recitals

A. The parties have entered into the Get Hands Master Services Agreement (the MSA). This Data Processing Addendum (the DPA) forms part of the MSA (MSA clause 1.1, definition of "Agreement").

B. As required by MSA clause 14.2, this DPA sets out the terms on which the Supplier handles personal information on behalf of the Client in supplying the Services.

The parties agree as follows:

1. Definitions and interpretation

1.1 Definitions. Capitalised terms used but not defined in this DPA have the meaning given to them in MSA clause 1.1 (including without limitation Client Data, Client Materials, Data Protection Laws, Personnel, Restricted Data, Seat Person, Security Overview, Service Document, Services and Studio Maker). In this DPA:

CCPA means the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020, and the regulations made under it.

Client Personal Data means personal information or personal data within the Client Data that the Supplier or any of its Sub-processors handles on behalf of the Client in supplying the Services.

Data Incident means a breach of security that leads to, or that the Supplier reasonably suspects has led to, the accidental or unlawful destruction, loss or alteration of, or unauthorised disclosure of or access to, Client Personal Data, including an eligible data breach under Part IIIC of the Privacy Act 1988 (Cth).

EU SCCs means the standard contractual clauses approved by the European Commission in Implementing Decision (EU) 2021/914.

Personnel Country means a country listed in Part B of Annex 3, as updated in accordance with clause 5 (including a country added by notice under clause 5.4(b)).

Restricted Transfer means a transfer of Client Personal Data that, under UK or EU Data Protection Laws, is lawful only if appropriate safeguards are in place.

Sub-processor means a person engaged by the Supplier that handles Client Personal Data, being Personnel (including any related entity or employer-of-record partner through which they are engaged) and Technology Providers.

Technology Provider means a provider of software, hosting or communication services listed in Part A of Annex 3.

UK Addendum means the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018 (UK), as in force from time to time.

US Privacy Laws means the CCPA and any other United States state law on consumer data privacy that applies to Client Personal Data.

1.2 Interpretation. The rules of interpretation in MSA clause 1.2 apply to this DPA. A reference to a clause or Annex is a reference to a clause of, or an Annex to, this DPA, unless the MSA or another document is named. The terms "controller", "processor", "personal data", "service provider", "contractor" and similar terms have the meaning given to them in the applicable Data Protection Laws, and "personal information" includes "personal data". In this DPA, "must" denotes an obligation, "must not" denotes a prohibition and "may" denotes a discretion or permission; "will" is used only for statements of future fact.

1.3 Precedence. MSA clause 2.2(b) governs the order of precedence between this DPA and the remainder of the MSA. To the extent of any conflict between the EU SCCs or the UK Addendum and this DPA, the EU SCCs or the UK Addendum (as applicable) prevail in respect of the Restricted Transfer to which they apply.

2. Scope and roles

2.1 Scope. This DPA applies whenever the Supplier or a Sub-processor handles Client Personal Data, in respect of Seats, Studio and Test Drives.

2.2 Client as controller. The Client is the controller of Client Personal Data (or, where the Client acts on behalf of another controller, a processor acting on that controller's instructions). Where the Client is an APP entity, the Supplier is its contracted service provider. Where US Privacy Laws apply, the Client is the "business" or "controller".

2.3 Supplier as processor. The Supplier handles Client Personal Data as the Client's processor and, for the purposes of US Privacy Laws, as the Client's service provider or contractor (MSA clause 14.2). Annex 1 describes the processing.

2.4 Supplier's own data. The Supplier is a separate controller, and its privacy policy published on the Supplier's website applies, in respect of: the names, contact details, user accounts and billing details of the Client's staff, which the Supplier uses to administer the relationship and the client app; and the personal information of its Personnel, including timesheets and monitoring data. This DPA does not apply to that data, except that clause 4.3 applies to protect that data in the same manner.

2.5 Seats within the Client's systems. Where a Seat Person works within the Client's own systems, the Client controls the accounts, permissions and data to which the Seat Person has access (MSA clause 6.3), and the Supplier controls the Seat Person, the Seat Person's device and the Seat Person's Supplier identity. The allocation of shared responsibility in Seat Schedule clause 7.4 applies.

3. Obligations of the Client

3.1 Lawful collection. The Client is responsible for having a lawful basis, and for giving any notices and obtaining any consents required by Data Protection Laws, for the Supplier and its Sub-processors to handle Client Personal Data for the purposes of the Services, including offshore access in accordance with MSA clause 14.3.

3.2 Lawful instructions. The Client's instructions must comply with Data Protection Laws.

3.3 Data tier and Restricted Data. For each Seat, the Client must declare the data tier in the Seat Schedule and must notify the Supplier of any change to it (Seat Schedule clause 7.2). The Client must not provide Restricted Data unless the Supplier has first agreed in writing (MSA clause 14.6). If Restricted Data reaches the Supplier or its Personnel without that agreement, the Supplier may suspend the affected work, notify the Client, and delete the data or request the Client to remove it, and MSA clause 14.8 applies.

4. Obligations of the Supplier

4.1 Instructions. The Supplier must handle Client Personal Data only on the Client's documented instructions, which comprise: the MSA, each Service Document and this DPA; the Client's settings and requests in the client app; and the Client's other written instructions, including, in respect of Seats, the tasks the Client directs (MSA clause 6.2). The Supplier must notify the Client promptly if, in the Supplier's opinion, an instruction breaches Data Protection Laws, and may suspend compliance with that instruction until it is confirmed or varied. If a law requires the Supplier to handle Client Personal Data otherwise, the Supplier must notify the Client before doing so, unless that law prohibits such notification.

4.2 Confidentiality of personnel. The Supplier must ensure that every person who handles Client Personal Data on its behalf is bound by a written duty of confidentiality and by the Supplier's data-handling rules before being given access (MSA clause 14.3(d)), and has access only to the extent necessary to perform the Services.

4.3 Security. The Supplier must maintain the technical and organisational measures set out in Annex 2 and in its Security Overview, appropriate to the risk. The Supplier may update those measures, but must not materially reduce the overall level of protection (MSA clause 21.2).

4.4 Australian Privacy Principles. The Supplier must comply with the APPs in handling Client Personal Data as if it were an APP entity, whether or not it is exempt (MSA clause 14.4), including APP 11 (security) and APP 8 (cross-border disclosure, clause 6.2).

4.5 AI tools. The Supplier and its Personnel may use only those AI tools approved by the Supplier, none of which uses Client Data to train its models (MSA clause 14.7). The AI providers among those tools are listed in Part A of Annex 3. If the Client switches off AI for its data in the client app or by written notice, the Supplier must cease using AI on that data within 1 Business Day.

4.6 No other use. The Supplier must not sell or share Client Personal Data, use it for advertising, combine it with personal information from other sources (except to the extent the law permits a processor or service provider to do so), or use it to build or improve services for any other person.

4.7 Records. Where Data Protection Laws so require, the Supplier must keep a record of its processing activities on behalf of the Client, and must provide that record to the Client or a regulator on request.

5. Sub-processors

5.1 General authorisation. The Client authorises the Supplier to engage, as Sub-processors:

(a) the Technology Providers listed in Part A of Annex 3; and

(b) Personnel located in the Personnel Countries, engaged directly or through a related entity or an employer-of-record partner (MSA clause 5.5).

Each Seat Schedule identifies the Seat Person and the Seat Person's country (MSA clause 5.8).

5.2 Terms with Sub-processors. Before a Sub-processor is given access to Client Personal Data:

(a) Personnel, related entities and employer-of-record partners must be bound in writing by confidentiality, privacy, security and intellectual property obligations that are consistent with the MSA and at least as protective of Client Personal Data as this DPA (MSA clause 5.5); and

(b) Technology Providers must be bound by their standard data-processing terms (MSA clause 5.5), which the Supplier must verify provide substantially the same protection as this DPA in respect of the processing they perform.

5.3 Responsibility. The Supplier remains responsible to the Client for the acts and omissions of its Sub-processors in relation to Client Personal Data as if they were the Supplier's own acts and omissions (MSA clauses 5.5 and 14.4).

5.4 Notice of changes. The Supplier must give the Client written notice:

(a) at least 30 days before adding or replacing a Technology Provider in Part A of Annex 3, or moving the location in which a listed Technology Provider stores Client Personal Data to another country; and

(b) at least 7 days before Personnel located in a country that is not then a Personnel Country first access Client Personal Data (MSA clause 5.8), including a replacement Seat Person under Seat Schedule clause 6.4.

The Supplier may add Personnel Countries as it sees fit by giving notice under clause 5.4(b), and the country becomes a Personnel Country when the notice period ends. Notice is given by email to the Client's notices address and in the client app, and the current lists of Technology Providers and Personnel Countries are maintained in the client app (Settings, Data providers) or, until available there, provided by the Supplier on request. In respect of a single Seat, the change in clause 5.4(b) may take effect sooner if the Client agrees in writing.

5.5 Objection. The Client may object to a change on reasonable data-protection grounds by written notice given within the notice period under clause 5.4 (30 days for a change under clause 5.4(a), and 7 days for a change under clause 5.4(b)). The parties must discuss the objection in good faith, and the Supplier must offer a reasonable alternative where it is able to do so (for example, not using the new provider or country for the Client's work). If the objection is not resolved before the change takes effect, the Client may terminate the affected Seats, Studio Subscription or Test Drive without penalty by written notice given before that date, and MSA clauses 20.2 and 21.3 apply in respect of refunds.

5.6 Urgent replacement. If the Supplier is required to replace a Technology Provider urgently for security, legal or continuity reasons, it may do so on as much notice as is reasonably practicable, and clause 5.5 then applies from the date of that notice.

6. Location and international transfers

6.1 Location of handling. The Client acknowledges, as set out in MSA clause 14.3, that:

(a) the Supplier's primary database for the Services is hosted in Australia;

(b) Personnel access Client Personal Data from the Personnel Countries, which at the date of this version are the Philippines, Vietnam, Kenya, Nigeria, Brazil and Colombia, together with any country later added under clause 5.4(b); and

(c) certain Technology Providers are hosted in the United States and other countries, as stated in Annex 3.

6.2 Australia (APP 8). Before any overseas recipient, including Personnel, is given access to Client Personal Data, the Supplier must take reasonable steps, including the binding written terms referred to in clause 5.2, to ensure that the recipient does not breach the APPs (APP 8.1). The Supplier does not rely on the consent exception in APP 8.2(b). The Supplier is accountable to the Client for those recipients as provided in MSA clause 14.4.

6.3 New Zealand. In respect of Client Personal Data subject to the Privacy Act 2020 (NZ), the Supplier must bind its Sub-processors to protect that data in a manner that, overall, provides safeguards comparable to those of that Act, for the purposes of Information Privacy Principle 12.

6.4 United Kingdom. In respect of a Restricted Transfer of Client Personal Data from the United Kingdom, the UK Addendum applies on the terms set out in Annex 4.

6.5 European Economic Area and Switzerland. In respect of a Restricted Transfer subject to the EU GDPR or the Swiss Federal Act on Data Protection, the EU SCCs apply on the terms set out in Annex 4.

6.6 Transfer risk assessments. The Supplier must keep a written transfer risk assessment for each Personnel Country and for each Technology Provider location outside Australia, and must provide the Client with a summary on request.

6.7 United States: countries of concern. The Supplier must not give any person who is located in, or is a citizen or resident of, a country of concern under the US Department of Justice rule on access to bulk sensitive personal data (28 CFR Part 202), or any entity owned or controlled from such a country, access to Restricted Data of that kind. None of the Personnel Countries is a country of concern at the date of this version.

6.8 Government requests. If a government authority requests Client Personal Data from the Supplier or a Sub-processor, the Supplier must, unless prohibited by law, notify the Client promptly, request the authority to approach the Client, disclose only the minimum required by law, and challenge any request that it reasonably considers unlawful.

7. Data Incidents

7.1 Notice to the Client. The Supplier must notify the Client without undue delay, and in any event within 48 hours, after becoming aware of a Data Incident. Notice is given by email to the Client's notices address and data protection contact (Annex 1), and by telephone where the Data Incident is serious. Personnel must report any suspected Data Incident to the Supplier within 2 hours.

7.2 Content of notice. To the extent then known, the Supplier must inform the Client of the nature and timing of the Data Incident, the categories and approximate number of individuals and records affected, the likely consequences, the steps taken and proposed to be taken, and a contact person. The Supplier must provide updates as further information becomes available, and must not delay the initial notice in order to collect complete information.

7.3 Response. The Supplier must promptly take reasonable steps to contain the Data Incident, investigate it, mitigate harm and prevent its recurrence, and must preserve relevant evidence.

7.4 Assistance with assessment and notification. The Supplier must give the Client the information and assistance that the Client reasonably requires, without charge (MSA clause 14.5), to:

(a) complete an assessment of a suspected eligible data breach within 30 days under Part IIIC of the Privacy Act 1988 (Cth), and make any notification as soon as practicable;

(b) notify a supervisory authority within 72 hours where required by the UK GDPR or EU GDPR; and

(c) meet any notification deadline under US Privacy Laws and other Data Protection Laws.

7.5 Responsibility for notification. The Client determines whether to notify regulators and affected individuals. The Supplier must not notify them of a Data Incident involving Client Personal Data without the Client's agreement, unless the law requires the Supplier to do so, in which case the Supplier must notify the Client beforehand where lawful. Where the Supplier and the Client each have a notification obligation in respect of the same Data Incident, they must coordinate so that, where the law permits, one statement covers both.

7.6 No admission and costs. Notification of a Data Incident is not an admission of fault. Breach Costs are recoverable as provided in MSA clause 16.4.

8. Assistance

8.1 Requests from individuals. If the Supplier receives a request from an individual to exercise a right in respect of Client Personal Data, the Supplier must pass the request to the Client within 2 Business Days and must not respond to it, other than to acknowledge it, unless the Client requests the Supplier to do so. The Supplier must assist the Client to respond, using the tools in the client app where possible.

8.2 Assessments and regulators. The Supplier must give the Client reasonable assistance with privacy impact assessments, data protection impact assessments, US Privacy Law risk assessments and cybersecurity audits, and consultations with regulators, in relation to the Services. Assistance beyond the Supplier's standard documents and tools may be charged at reasonable rates, quoted in writing in advance. Assistance in respect of a Data Incident is never charged (clause 7.4).

8.3 Regulators' requests to the Supplier. If a regulator contacts the Supplier in relation to Client Personal Data, the Supplier must notify the Client promptly, where lawful.

9. Audit and information

9.1 Information. On request, the Supplier must give the Client the information reasonably necessary to demonstrate the Supplier's compliance with this DPA, including its Security Overview, responses to a reasonable security questionnaire once in any 12 months, a summary of its transfer risk assessments, and any certifications or independent audit reports that it holds.

9.2 Audits. If that information is insufficient to demonstrate compliance, the Client, or an independent auditor appointed by the Client that is bound by confidentiality and is not a competitor of the Supplier, may audit the Supplier's compliance with this DPA:

(a) once in any 12 months, and additionally after a Data Incident or where a regulator so requires;

(b) on at least 30 days' written notice, or 5 Business Days' notice after a Data Incident or where a regulator so requires;

(c) during business hours, remotely where possible, within an agreed scope, and in a manner that minimises disruption and protects the confidentiality of the Supplier's other clients and the privacy of its Personnel; and

(d) without entering the homes of Personnel, in respect of which the Supplier must instead provide remote evidence (such as device-management reports and access logs).

9.3 Costs and findings. Each party bears its own costs of an audit, unless the audit reveals a material breach of this DPA by the Supplier, in which case the Supplier must pay the Client's reasonable audit costs. The Supplier must remedy any non-compliance identified by an audit without undue delay and at its own cost.

10. Return and deletion

10.1 On cessation of the Services. Within 30 days after a Seat, Studio Subscription or Test Drive ends, or earlier on the Client's written request, the Supplier must, at the Client's election, return the Client Personal Data relating to that Service (by export from the client app or in another common format) or delete it.

10.2 Studio. In respect of Studio and Test Drives, the Supplier retains Briefs, files and Deliverables for 90 days after the end date, offers an export before deletion, and then deletes them (Studio Subscription Terms clause 13.6), unless the Client requests earlier deletion.

10.3 Seats. When a Seat ends or a Seat Person is replaced or removed, the Supplier must ensure that the Seat Person deletes any Client Personal Data held outside the Client's systems, that any Supplier-managed device is wiped or returned, and that the Seat Person's access to the Supplier's systems is removed, and must confirm this to the Client in writing within 10 Business Days. The Client is responsible for removing access to its own systems (MSA clauses 6.3(c) and 20.4).

10.4 Default deletion and backups. If the Client makes no election, the Supplier must delete Client Personal Data within 90 days after the relevant Service ends. Copies held in backups are deleted as the backups expire, within a further 35 days, and remain protected under this DPA until then.

10.5 Retention required by law. The Supplier may retain Client Personal Data to the extent, and only for so long as, a law requires. While it does so, this DPA continues to apply and the Supplier must use that data only for the purpose required by that law.

10.6 Certificate. On request, the Supplier must confirm deletion in writing.

11. Liability

11.1 MSA clause 16 applies. Each party's liability under or in connection with this DPA, including under the EU SCCs and the UK Addendum as between the parties, is subject to MSA clause 16. A breach of this DPA falls within the Enhanced Cap (MSA clause 16.2: AUD $25,000, or £12,500 or US$17,500, at the date of this version), and not the General Cap of AUD $5,000 (MSA clause 16.1). Breach Costs are recoverable as provided in MSA clause 16.4, and MSA clause 16.3 sets out the matters that the caps do not limit. Liability under the MSA and this DPA is aggregated, and not counted separately.

11.2 Restricted Data. MSA clause 14.8 applies to Restricted Data provided without the Supplier's written agreement.

11.3 Rights of individuals. Nothing in this DPA limits any right that an individual has against either party which cannot be limited by law, including under clause 12 of the EU SCCs.

12. Term and changes

12.1 Term. This DPA continues to apply for so long as the Supplier or a Sub-processor holds Client Personal Data, notwithstanding the termination or expiry of the MSA (MSA clause 20.5).

12.2 Updates. The Supplier updates Annex 3 in accordance with clause 5, and its security measures in accordance with clause 4.3 and MSA clause 21.2. Any other change is made in accordance with MSA clause 21, including changes required by law (MSA clause 21.5), and MSA clause 21.3 gives the Client a right to exit if a change materially disadvantages it.

12.3 Replacement transfer tools. If the UK Information Commissioner or the European Commission replaces or updates a transfer tool referred to in Annex 4, the parties agree that the replacement applies from its effective date, completed with the details in this DPA.

12.4 Governing law. MSA clause 24.1 applies, except that the EU SCCs and the UK Addendum are governed as provided in Annex 4.

Annex 1: Details of processing

Annex 2: Security measures

Data tiers. In this Annex: T1 means business data with no or minimal personal information; T2 means customer personal information; and T3 means regulated or sensitive data, including Restricted Data agreed under MSA clause 14.6. The tier for each Seat is the tier declared in its Seat Schedule (clause 3.3).

The Supplier must implement and maintain measures including the following, as they apply to the relevant work:

People

• Identity verification with a liveness check, sanctions screening and reference checks for all Personnel, and police certificates where lawful.
• Confidentiality, data-handling, security and intellectual property terms executed before any access to Client Data.
• Security and privacy training at onboarding and annually thereafter.
• Personnel work only from their declared Personnel Country, and must give 30 days' notice before relocating to another country.

Devices

• Personnel use Supplier-managed work devices or Client-issued devices, with full-disk encryption, automatic updates, endpoint protection, a screen lock after 5 minutes, removable storage blocked for T2 and T3 work, and remote-control tools blocked unless approved.
• A personal device is used only as a short, time-limited bridge, through a cloud PC, and never for T3 (regulated) data.

Identity and access

• Single sign-on with multi-factor authentication (Microsoft Entra ID) for the Supplier's staff and Personnel.
• A business password manager for any credentials provided by the Client.
• Least-privilege access, with sign-ins blocked from countries other than the Personnel Countries and Australia.
• Access removed within 1 hour of a removal under MSA clause 19.4, and otherwise by the end of the last working day.

Data

• Encryption in transit (TLS 1.2 or higher) and at rest.
• No Client Data in personal accounts or unapproved AI tools, and no local copies unless approved by the Client.
• T3 work performed only on cloud PCs with clipboard, printing and drive redirection disabled.
• Secrets, keys and card numbers removed from AI requests before they are sent.

Application

• The client app and talent app operate in Sydney, Australia, with the primary database in Sydney.
• Passwords hashed with argon2id and checked against known breached passwords, rate-limited sign-in, and multi-factor authentication for privileged roles.
• Audit logging, daily backups with tested restores, and retention limits.

Monitoring

• Disclosed time and activity data on work devices, limited to working hours. No keystroke logging, webcam, microphone or location tracking at any time (Seat Schedule clause 7.3).

Incidents

• A written incident response plan and playbooks.
• Personnel report suspected incidents within 2 hours. The Client is notified within 48 hours (clause 7.1).

Annex 3: Sub-processors

Part A: Technology Providers

Part B: Personnel Countries

At the date of this version, Personnel are engaged by the Supplier as independent contractors in every Personnel Country. The Supplier may in future engage Personnel through a related entity or an employer-of-record partner, as contemplated by clause 5.1(b). At the date of this version, Personnel access Client Personal Data only from the following countries (MSA clause 14.3(b)). The Supplier may add a Personnel Country on 7 days' notice under clause 5.4(b), and the current list is maintained in the client app or, until available there, provided by the Supplier on request:

Part C: Providers that hold only the Supplier's own data (for information only; not Sub-processors)

These providers handle data of which the Supplier is the controller (clause 2.4), such as billing contacts and Personnel records. They are listed for the Client's information only. They are not Technology Providers, and clause 5.4 does not apply to changes to this Part C.

Annex 4: UK and EU transfer terms

4.1 EU SCCs. In respect of a Restricted Transfer subject to the EU GDPR:

(a) the EU SCCs are incorporated into this DPA by reference;

(b) Module 2 (controller to processor) applies where the Client is a controller, and Module 3 (processor to processor) applies where the Client is a processor;

(c) clause 7 (docking clause) applies;

(d) in clause 9, option 2 (general written authorisation) applies, with the notice periods in clause 5.4 (30 days for a Technology Provider and 7 days for a new Personnel Country);

(e) the optional wording in clause 11 does not apply;

(f) in clause 13, the supervisory authority is the supervisory authority competent in respect of the Client;

(g) in clauses 17 and 18, the law and courts of Ireland apply; and

(h) Annexes I and II of the EU SCCs are completed with Annex 1 and Annex 2 of this DPA, and Annex III with Annex 3. The Client is the data exporter and the Supplier is the data importer.

4.2 Switzerland. In respect of a Restricted Transfer subject to the Swiss Federal Act on Data Protection, the EU SCCs apply as set out in clause 4.1 of this Annex, with references to the EU GDPR read as references to that Act, the Swiss Federal Data Protection and Information Commissioner as the supervisory authority, and Switzerland included as a place in which individuals may bring claims.

4.3 United Kingdom. In respect of a Restricted Transfer subject to the UK GDPR, the UK Addendum is incorporated by reference. Tables 1 to 3 are completed with the details in clause 4.1 of this Annex and in Annexes 1 to 3 of this DPA. In Table 4, neither party may terminate the UK Addendum when the approved Addendum changes.

4.4 Onward transfers. The Supplier must impose the same safeguards on onward transfers to its Sub-processors, by means of the EU SCCs Module 3, the UK Addendum or another lawful mechanism.

Annex 5: US privacy terms

Where the Supplier acts as the Client's service provider, contractor or processor under US Privacy Laws, the Supplier:

(a) must handle Client Personal Data only for the business purposes set out in Annex 1, which are the limited and specified purposes for which the Client discloses it;

(b) must not sell or share it, as those terms are defined in the CCPA, and must not use it for cross-context behavioural advertising;

(c) must not retain, use or disclose it outside the direct business relationship with the Client, or for any purpose other than the business purposes set out in Annex 1;

(d) must not combine it with personal information from other sources, except as permitted by US Privacy Laws;

(e) must comply with US Privacy Laws and provide it with the same level of privacy protection as those laws require, and must notify the Client if it can no longer meet its obligations;

(f) must permit the Client to take reasonable and appropriate steps to ensure that the Supplier uses it in a manner consistent with the Client's obligations, and to stop and remediate any unauthorised use, including through clause 9;

(g) must bind every Sub-processor by written contract to terms no less protective than this Annex, and must give the Client notice and an opportunity to object in accordance with clause 5;

(h) must delete or return it at the end of the Services in accordance with clause 10, unless the law requires it to be retained;

(i) where it receives deidentified data, must keep that data deidentified, must not attempt to reidentify it, and must contractually require the same of its Sub-processors;

(j) must assist the Client to respond to consumer requests (clause 8.1) and to complete risk assessments and cybersecurity audits (clause 8.2); and

(k) certifies that it understands and will comply with the restrictions in this Annex.

Execution

This DPA is executed or accepted electronically in accordance with MSA clause 3.6.