Spirity Enterprise Middle East FZCO (from hereinafter: “Spirity”) and Client entity that is party to the Terms of Service is party to this DPA. Client’s Authorized Affiliates will also be covered by this DPA, provided that Client shall remain responsible for the acts and omissions of its Authorized Affiliates. For the avoidance of doubt, the Client entity that is the contracting party to the Agreement shall, on behalf of itself and its Authorized Affiliates: (a) remain responsible for coordinating, making, and receiving all communication with Spirity under this DPA; and (b) exercise any rights herein in a combined manner with Spirity under this DPA.

1.1. In this DPA the following terms shall have the meanings set out in this Paragraph 1.1, unless expressly stated otherwise:

• (a) “Agreement” means every service contract, including the Terms of Service between Spirity and Client

• (b) “Business Day” means any day which is not a Saturday, Sunday or public holiday, and on which the banks are open for business, in Dubai (UAE).

• (c) “Cessation Date” has the meaning given in Paragraph 2.8.

• (d) “Data Protection Laws” means the EU General Data Protection Regulation 2016/679 (the “GDPR”) and any implementing legislation or legislation having equivalent effect in every country member of the European Economic Area (references to “Articles” or “Chapters” of the GDPR shall be construed accordingly). It also means the Personal Data Protection Law of the UAE – Federal Decree-Law No. 45. of 2021 (the “PDPL”).

• (e) “Data Subject Request” means the exercise by Data Subjects of their rights under, and in accordance with, Chapter III of the GDPR.

• (f) “Data Subject” means the identified or identifiable natural person located in the European Economic Area to whom Client Personal Data relates.

• (g) “Delete” means to remove or obliterate Personal Data such that it cannot be recovered or reconstructed, and “Deletion” shall be construed accordingly.

• (h) “Client Personal Data” means any Personal Data Processed by or on behalf of Client

• (i) “Personal Data” has the same meaning as in Data Protection Laws.

• (j) “Personnel” means a person’s employees, agents, consultants or contractors.

• (k) “Processing” has the same meaning as in the Data Protection Laws and means inter alia obtaining, recording, holding, alteration, manipulating, transmission, disclosure, erasure or destruction of data.

• (l) “Sub-processor” means any third party appointed by or on behalf of Spirity to Process Client Personal Data.

• (m) “DPA” means Data Protection Addendum.

• (n) “Client” means users with paid or non-paid license as well.

• (o) “Instructions” means the content of present DPA and the Terms of Service between the Client and Spirity. Parties agree that these two documents constitute as documented instructions regarding Spirity’s processing of Client Personal Data.

​

1.2. This DPA is made in accordance with Article 28 of the GDPR.

​

1.3. In this DPA:

​

• (a) the terms, “Data Controller”, “Data Processor”, “Personal Data”, “Personal Data Breach”, “Process” (and its derivatives) and “Supervisory Authority” shall have the meaning ascribed to the corresponding terms in the Data Protection Laws;

• (b) unless otherwise defined in this DPA, all capitalized terms shall have the meaning given to them in the Agreement.

​

1.4. Spirity warrants and represents that it is subject to the territorial scope of the Data Protection Laws as determined in accordance therewith. Spirity further agrees that to the extent that it is not in fact subject to the territorial scope of the Data Protection Laws, this DPA shall be deemed automatically void with effect from the Effective Date without requirement of notice.

2.1. Spirity warrants and undertakes

​

• (a) to treat as confidential all Client Personal Data which may be derived form or obtained in the course of the contract or which may come into the possession of Spirity or any Personnel as a result of or in connection with the Services; and

• (b) to provide all necessary precautions to ensure that all Client Personal Data is treated as confidential by Spirity or any Personnel; and

• (c) to make sure Client Personal Data is only disclosed to persons specified by Client; and

• (d) to allow access to any Client Personal Data provided by Client only to persons who are involved in the provision of Services; and

​

2.2. Spirity shall comply at all times with the Data Protection Laws and shall not perform its obligations under Services in such a way as to cause of any Client to breach any of its applicable obligations under the Data Protection Laws.

​

2.3. The parties agree that with regard to the Processing of Personal Data by Spirity on behalf of Client, Client is the Controller, Spirity is the Processor and that Spirity will engage Sub-processors as further detailed in Section 5 “Sub-processing” below.

​

2.4. Client represents and warrants on an ongoing basis – with regards to GDPR (6) – there is and will be throughout the term of the agreement a valid legal basis for Processing by Spirity of Client Personal Data in accordance with this DPA and the Agreement (including any and all instructions issued by Client from time to time in respect of such processing).

​

2.5. Taking into account the nature of the Processing, Spirity provides appropriate technical and organizational measures, insofar as this is possible, for the fulfilment of the Client obligations, as reasonably understood by Client, to respond to requests to exercise Data Subject rights under the Data Protection Laws.

​

2.6. Spirity warrants and undertakes to:

​

• (a) Process Client Personal Data only in accordance with Instructions from Client as needed for Services;

• (b) Additional instructions outside the scope of the Instructions (if any) require prior written agreement between Spirity and Client, including agreement on any additional fees payable by Client to Spirity for carrying out such Instructions;

• (c) Process Client Personal Data only to the extent, and in such manner, as is necessary for the purpose of Services, or as is required by law or any supervisory body and shall process such personal data in compliance with all applicable Data Protection Laws, regulations, orders, standards and other similar instruments;

​

2.7. Spirity shall notify Client promptly (but in any event within two (2) business days) should it:

​

• (a) Receive notice of any complaint made to a Supervisory Authority or any finding by a Supervisory Authority in relation to its Processing of Client Personal Data;

• (b) be under a legal obligation to process Client Personal Data, other than under the instructions of the Client. In which case it shall inform Client of the legal obligations, unless the law prohibits such information being shared on important grounds of public interest;

• (c) receives any Data Subject Request on behalf of a Data Subject of Client Personal Data;

• (d) become aware that in following the instructions of Client, it shall be breaching Data Protection Laws.

​

2.8. Subject to Paragraph 2.9, upon the date of cessation of any Services involving the Processing of Client Personal Data (the “Cessation Date”), Spirity shall immediately cease all Processing of the Client Personal Data for any purpose other than for storage unless.

2.9. To the fullest extent technically possible in the circumstances, within forty-five (45) Business Days after the Cessation Date, Spirity shall either (at its option):

​

• (a) Delete; or

• (b) irreversibly render Anonymized Data,

all Client Personal Data then within Spirity’s possession.

​

2.10. Client hereby acknowledges and agrees that, due to the nature of the Client Personal Data Processed by Spirity, return (as opposed to Deletion) of Client Personal Data is not a reasonably practicable option in the circumstances. Having regard to the foregoing, Client agrees that (for the purposes of Article 28(3)(g) of the GDPR) it is hereby deemed (at the Cessation Date) to have irrevocably selected Deletion, in preference of return, of the Client Personal Data.

​

2.11. Spirity and any Sub-processor may retain Client Personal Data where required by applicable law, for such period as may be required by such applicable law, provided that Spirity and any such Sub-processor shall ensure that such Client Personal Data is only Processed as necessary for the purpose(s) specified in the applicable law requiring its storage and for no other purpose.

​

2.12. Client acknowledges and agrees that Spirity shall be freely able to use and disclose Anonymized Data for Spirity’s own business purposes without restriction.

​

2.13. Spirity shall ensure that its personnel engaged in the Processing of Personal Data are (a) informed of the confidential nature of the Personal Data and have executed written confidentiality agreements; (b) have received appropriate training on their responsibilities, specifically pertaining to security and privacy measures; and (c) only have access to Personal Data to the extent reasonably determined to be necessary in order to perform any obligations, responsibilities, or duties as further specified in this DPA and the Agreement. Further, to the extent permitted by applicable law, Spirity shall ensure that the confidentiality obligations shall survive the termination of the personnel engagement.

3.1. Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of Processing as well as the risk (which may be of varying likelihood and severity) for the rights and freedoms of natural persons, Spirity shall in relation to Client Personal Data implement appropriate technical and organizational measures to ensure a level of security appropriate to that risk, including, as appropriate, the measures referred to in Article 32(1) of the GDPR.

​

3.2. In assessing the appropriate level of security, Spirity shall take account in particular of the risks presented by the Processing, in particular from a Person

​

3.3. Spirity maintains security incident management policies and procedures and shall notify Client, without undue delay, of any breach of its security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Client Personal Data, transmitted, stored or otherwise Processed by Spirity or its Sub-processors of which Spirity becomes aware and which requires notification to be made to Client, a Supervisory Authority and/or Data Subject under Data Protection Laws and Regulations (a “Security Incident”). Security Incident(s) will not include unsuccessful attempts or activities that do not compromise the security of Client Personal Data, including unsuccessful log-in attempts, pings, port scans, denial of service attacks, and other network attacks on firewalls or networked systems. Notification provided under this Section 3 shall not be interpreted or construed as an admission of fault or liability by Spirity. Spirity shall make reasonable efforts to identify the cause of such Security Incident and take those steps as Spirity deems necessary and reasonable in order to remediate the cause of such a Security Incident to the extent the remediation is within Spirity’s reasonable control. Additionally, upon request, Spirity shall provide Client with relevant information about the Security Incident, as reasonably required to assist the Client in ensuring Client’s compliance with its own obligations under Data Protection Laws to notify any Supervisory Authority or Data Subject in the event of a Security Incident. The obligations herein shall not apply to incidents that are caused by Client or Client’s users or any non- Spirity products or services.

​

3.4. Spirity shall at Client’s sole cost and expense co-operate with Client and take such reasonable commercial steps as may be directed by Client to assist in the investigation, mitigation and remediation of each such Personal Data Breach.

4.1. Spirity shall provide on request all necessary information and assistance to Client in order for Client to verify Spirity’s compliance with its obligations under this Agreement and the Data Protection Laws. Client may request such information and/or assistance on material change, but maximum once a year.

​

4.2. Spirity shall make available to Client on request such information as Spirity (acting reasonably) considers appropriate in the circumstances to demonstrate its compliance with this DPA.

​

4.3. Subject to Paragraphs 4.5 and 4.6, in the event that Client (acting reasonably) is able to provide documentary evidence that the information made available by Spirity pursuant to Paragraph 4.2 is not sufficient in the circumstances to demonstrate Spirity’s compliance with this DPA, Spirity shall allow for and contribute to audits by Client or an auditor mandated by Client in relation to the Processing of the Client Personal Data by Spirity.

4.4. Client shall give Spirity reasonable notice of any audit or inspection to be conducted under Paragraph 4.5 (which shall in no event be less than fifteen (15) Business Days’ notice unless required by a Supervisory Authority pursuant to Paragraph 4.5(f)) and shall use its best efforts (and ensure that each of its mandated auditors uses its best efforts) to avoid causing any form of damage, and hereby indemnifies Spirity in respect of, any damage, injury or disruption to Spirity’s equipment, Personnel, data, and business (including any interference with the confidentiality or security of the data of Spirity’s other Clients or the availability of Spirity’s services to such other Clients) while its Personnel and/or its auditor’s Personnel (if applicable) are on those premises in the course of any on-premise inspection.

4.5. Spirity need not contribute to audits or inspection:

​

• (a) to any individual unless he or she produces reasonable evidence of their identity and authority;

• (b) to any auditor whom Spirity has not given its prior written approval (not to be unreasonably withheld);

• (c) unless the auditor enters into a non-disclosure agreement with Spirity on terms acceptable to Spirity;

• (d) where, and to the extent that, Spirity considers, acting reasonably, that to do so would result in interference with the confidentiality or security of the data of Spirity’s other Clients or the availability of Spirity services to such other Clients;

• (e) outside normal business hours ; or

• (f) on more than one occasion in any calendar year during the term of the Agreement, except for any additional audits or inspections which Client is required to carry out by Data Protection Laws or a Supervisory Authority, where Client has identified the relevant requirement in its notice to Spirity of the audit or inspection.

4.6. Client shall bear any third-party costs in connection with such inspection or audit and reimburse Spirity for all costs incurred by Spirity and time spent by Spirity (at Spirity’s then-current professional services rates) in connection with any such inspection or audit.

5.1. Client authorizes Spirity to appoint Sub-processors in accordance with this Paragraph 5.

5.2. Spirity may continue to use those Sub-processors already engaged by Spirity as at the date of this DPA, subject to Spirity meeting within a reasonable timeframe (or having already met) the obligations set out in Paragraph 5.4.

5.3. Spirity shall give Client prior written notice of the appointment of any new Sub-processor, including reasonable details of the Processing to be undertaken by the Sub-processor. Client may in good faith reasonably object to the use of a new Sub-processor by notifying Spirity promptly in writing (e-mail acceptable) within thirty (30) business days after Spirity’s notice. After the thirty business days have passed without you reaching out to us we consider it as an approval of our new Sub-processor. Client’s notice shall explain the Client’s good faith, reasonable grounds for the objection. Spirity and Client shall try to negotiate to remedy the situation, and come to a conclusion, that is acceptable for both parties. If the parties are unable to resolve the objection via negotiations, Spirity will use commercially reasonable efforts to make available to Client a change in the services or recommend a commercially reasonable change to Client’s use of the services to avoid Processing of Client Personal Data by the objected-to new Sub-processor without unreasonably burdening the Client.

5.4. With respect to each Sub-processor, Spirity shall ensure that the arrangement between Spirity and the Sub-processor is governed by a written contract including terms which offer at least an equivalent level of protection for Client Personal Data as those set out in this DPA (including those set out in Paragraph 3).

5.5 Spirity shall promptly forward any received instructions or requests from Client to the Sub-processor relating to the processing.

6.1. Spirity may transfer or authorize the transfer of Data to countries within the UAE, the EU and/or the European Economic Area (EEA) and to countries that the European Commission has recognized as providing adequate protection – this includes sub-processors. If personal data processed under this Agreement is transferred from a country

within the European Economic Area to a country outside the European Economic Area, Spirity shall ensure that the personal data are adequately protected. To achieve this, Spirity shall, unless agreed otherwise, rely on EU approved standard contractual clauses for the transfer of Client Personal Data.

​

6.2. Spirity shall only engage the Subprocessor after assessing the applicable law for the sub-processor and reasonably concluding that the applicable law does not conflict with Spirity’s obligations under the sub-processing agreement and applicable Data Protection Laws

7.1 Each party’s and all of its Affiliates’ liability, in the aggregate, arising out of or related to this DPA, and all DPAs between Authorized Affiliates and Spirity, whether in contract, tort or under any other theory of liability, is subject to the Terms of Service, and any reference to the liability of a party means the total liability of that party and all of its Affiliates under the Agreement and all DPAs together.