Data Processing Addendum (UK)

an obligation of any Party to indemnify any person against a Liability is to be construed as including an obligation to indemnify and hold harmless and keep that person indemnified on demand and in full from and against each Liability incurred as a result of suffering, defending or settling a claim alleging that Liability; and

references to “writing” and “written” shall include email but not fax.

implement appropriate technical and organisational measures to protect against Personal Data Breaches affecting Customer Personal Data;

be generally authorised by Customer in writing to engage with any other Processor to Process the Customer Personal Data (“Sub-Processor”) subject to Onroute notifying the Customer of any intended changes concerning the addition or replacement of Sub-Processor(s) and permitting Customer to object to such changes in writing within ten (10) days from the date that it is notified by Onroute. If no objection is received by Onroute within such time period, Customer shall be deemed to have given its approval to use such Sub-Processor. Onroute shall use its reasonable (but commercially prudent) endeavours to ensure that any Sub-Processor agrees in writing to comply with obligations materially equivalent to those imposed on Onroute in this Clause 2. If Customer does not consent to use of such Sub-Processors, Onroute shall be entitled to terminate the Services and this DPA immediately by notice in writing. A list of Onroute’s current Sub-Processors is published as part of Onroute’s Trust and Compliance documentation at https://www.onroute.io/trustandcompliance (or a successor location notified to Customer);

only Process Customer Personal Data in accordance with Customer’s documented instructions from time to time except to the extent necessary to comply with applicable law. For the avoidance of doubt, the provisions of this DPA are not instructions for the purposes of this Clause 2.2.3;

notwithstanding Clause 2.2.3, have no obligation to comply (nor any Liability for non-compliance) with any of Customer’s instructions which will or are likely to (in Onroute’s opinion): (a) vary the provisions of this DPA; (b) be inconsistent with the Description of Processing; or (c) breach any Applicable Data Protection Laws, and shall notify Customer in writing of the same. The Customer shall seek its own independent legal advice to determine whether any instruction received by Onroute and which Onroute believes is infringing is in fact infringing or likely to be infringing;

not transfer any Customer Personal Data outside of the UK or European Economic Area (“EEA”) if such transfer would directly cause Customer to breach its obligations under Article 44 of the UK GDPR. Subject to the foregoing provisions of this Clause 2.2.5, Customer hereby consents to Onroute and its Sub-Processors transferring Customer Personal Data outside the UK or EEA. Where such a transfer is a restricted transfer for the purposes of the UK GDPR, it shall be made under the International Data Transfer Agreement issued by the Information Commissioner under section 119A of the Data Protection Act 2018 and in force from 21 March 2022 (the “IDTA”), as completed in Schedule 2 to this DPA, which is incorporated into and forms part of this DPA; save that, where the recipient is certified under and the transfer is covered by the UK Extension to the EU–US Data Privacy Framework (or another adequacy regulation or adequacy decision then in force under the UK GDPR), the transfer may instead be made in reliance on that framework or adequacy for so long as it applies. For the purposes of the IDTA, Customer is the data exporter and the relevant recipient is the data importer, and Customer’s entry into the Onroute Subscription Terms and this DPA is treated as its entry into the IDTA as provided in clause 5.2 of the Onroute Subscription Terms. Customer shall promptly complete or enter into any further transfer documentation that Onroute reasonably requires in order to comply with the Data Protection Clauses and/or Applicable Data Protection Laws;

ensure that all Onroute Personnel who have access to and/or Process Customer Personal Data are committed to keeping Customer Personal Data confidential;

notify Customer without undue delay and in writing if Onroute becomes aware of a breach of security of Customer Personal Data, together with particulars of the breach to the extent available to Onroute;

provide such assistance (at Customer’s cost and to such extent permitted by Applicable Data Protection Laws) as Customer may reasonably require in responding to any request from a Data Subject and in ensuring compliance with its obligations under Applicable Data Protection Laws with respect to security, breach notifications, impact assessments, consultations with a supervisory authority, and (where applicable) automated decision-making and AI-transparency requirements. In no event shall Onroute be obliged to respond directly to any such request or correspondence unless specifically required to do so by law; and

for the sole purpose of demonstrating Onroute’s compliance with the Data Protection Clauses, provide such information as Customer reasonably requires, or, where the provision of information alone is not reasonably sufficient for that purpose, allow for and contribute to an audit of Onroute by up to two (2) of Customer’s representatives (in each case, at Customer’s cost, including any auditors’ or administrative fees). Customer shall give not less than one (1) month’s prior written notice prior to the date it wishes to conduct the audit and shall conduct any such audit no more than once per calendar year at such time and date that is convenient for Onroute (except where required otherwise by a supervisory authority with competent jurisdiction). Any non-compliance discovered by such audit will be promptly notified by Customer to Onroute in writing. Customer shall not disclose to any third party (other than, where applicable, the external auditor performing the audit) any information or reports obtained or produced in connection with any such audit and shall use such information and reports solely for the purposes of meeting its regulatory audit requirements and/or confirming Onroute’s compliance with the requirements of the Data Protection Clauses. Customer shall ensure that it takes reasonable steps and any steps requested by Onroute to minimise any interruption to the business of Onroute when exercising its rights under this Clause 2.2.9. If a third party conducts the audit, Onroute may object to the auditor if the auditor is, in Onroute’s reasonable opinion, not suitably qualified or independent, a competitor of Onroute, or otherwise manifestly unsuitable. Such objection by Onroute will require Customer to appoint another auditor or conduct the audit itself;

not use, and shall procure that its Sub-Processors do not use, any Customer Personal Data to train, fine-tune or otherwise develop any artificial-intelligence or machine-learning model in any form that identifies, or can reasonably be used to identify, any individual; except that Onroute may aggregate, anonymise or de-identify Customer Personal Data so that it no longer constitutes Personal Data (and cannot reasonably be used by any person to identify any Data Subject) and may use the resulting data solely to operate, secure, analyse, develop, train and improve its own systems, products and services (including through third-party providers of artificial-intelligence models and services engaged as Sub-Processors to host, train, fine-tune or evaluate models for Onroute), and not to make that data or any resulting model available to any third party for that third party’s own purposes, and Onroute will not authorise any third party to use Customer Personal Data that identifies any individual to train that third party’s own generally available models; and

where the Services include AI features, Process Customer Personal Data through third-party providers of artificial-intelligence models and services engaged by Onroute as Sub-Processors, solely to provide those features in accordance with Customer’s instructions and the Onroute Subscription Terms. Such engagement is subject to Clause 2.2.2 (Sub-Processors) and the transfer provisions of Clause 2.2.5, and any development, training, fine-tuning or evaluation of models is subject to Clause 2.2.10.

ensure that the Description of Processing at all times accurately reflects Onroute’s Processing of Customer Personal Data as a Processor for Customer in relation to the Services. Where Customer requires changes to the Description of Processing it shall provide an amended version (a “Revised Description”) to Onroute. Such Revised Description shall be deemed to have replaced the Description of Processing within five (5) days of Onroute’s written confirmation and this DPA shall be deemed amended accordingly on that date. If the nature of the Processing under this DPA changes in such a way as to change the scope of the Services, Onroute shall be entitled to amend the charges for the Services accordingly;

ensure that all instructions it issues to Onroute comply with Applicable Data Protection Laws;

be and remain solely responsible for determining the legal basis and conditions for the Processing of all Customer Personal Data under this DPA;

indemnify Onroute against all Liabilities arising out of or in connection with any breach by Customer of any of the terms of this Clause 2.3, including all amounts paid or payable by Onroute or any of its Related Persons to a third party which would not have been paid or payable if Customer’s breach of this Clause 2.3 had not occurred; and

where Customer uses any AI feature or agent to communicate with, or to make or support decisions affecting, individuals, be solely responsible as Controller for compliance with Applicable Data Protection Laws in respect of that use, including any transparency and automated-decision-making requirements, and for making any disclosure required by law that an individual is interacting with, or receiving content generated by, artificial intelligence.