Data Processing Addendum

This Data Processing Addendum ("DPA") supplements LEX Reception's Terms and Conditions of Supply (the "Agreement"). Any definitions used in the Agreement shall apply to this DPA. This DPA shall apply solely to the Processing of Personal Data that is regulated under Data Protection Laws and Regulations (see definitions set forth is Section 1 below).

1. Definitions

The terms used in this DPA shall have the following meaning:

• a) Data Protection Laws and Regulations means the UK GDPR as described in section 3(10) (as supplemented by section 205(4)) of the Data Protection Act 2018 as the UK version of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016.
• b) The terms controller, processor, data subject, personal data, personal data breach and processing shall have the meaning given to them in the Data Protection Laws and Regulations.

2. Processing of Personal Data

• a) Roles of the Parties. The parties agree that Customer is the controller solely responsible for determining the purposes and means of the processing of personal data, and LEX Reception is Customer's processor responsible for processing personal data on behalf of the controller. As further discussed in this DPA, LEX Reception shall only take action pursuant to instructions of Customer with regards to processing personal data. LEX Reception may engage sub-processors to process personal data pursuant to the requirements set forth in Section 3 "Sub-Processors" below.
• b) User's Obligations. The Customer is solely responsible for its compliance with the Data Protection Laws and Regulations, including without limitation the lawfulness of any transfer of personal data to LEX Reception and the processing of personal data by LEX Reception as set forth in the Agreement. The Customer shall have sole responsibility for (i) the accuracy, quality, and legality of personal data provided to LEX Reception; (ii) the means by which the Customer acquires personal data, including providing any required notices to, and obtaining any necessary acknowledgements, authorizations or consents from, data subjects; (iii) the legality of transfers of Customer data, including without limitation data from the Customer's affiliates, partners and users of the Services from LEX Reception. The Customer takes full responsibility to keep the amount of personal data provided to LEX Reception to the minimum necessary in order for LEX Reception to provide the Services. The Customer shall be solely responsible for establishing and maintaining any data processing registers or overview (including without limitation any records of processing, any records of consents, or any other required documentation) as may be required by any applicable law, including but not limited to the Data Protection Laws and Regulations.
• c) User's Right to Issue Instructions. Except as necessary to comply with an applicable law or regulation, court order or other legal process, LEX Reception shall only process personal data in accordance with Customer's instructions or otherwise as required in order to provide the Services. For the avoidance of doubt, but not by way of limitation, Customer's instructions for the processing of personal data must comply with Data Protection Laws and Regulations. Customer's initial instructions for the processing of personal data are defined by the Agreement including without limitation this DPA, Schedule 1 to this DPA, and any applicable order form, statement of work, or similar agreement regarding the Services. Subject to the terms of this DPA and with mutual agreement of the parties, Customer may issue additional written instructions concerning the type, extent and procedure of processing. Any changes of the subject matter of processing and of procedures shall be agreed upon by the parties in writing prior to becoming effective. The Customer is responsible for ensuring that all individuals who provide written instructions to LEX Reception are authorised by the Customer to issue instructions to LEX Reception. LEX Reception will inform Customer of any instruction that it deems to be in violation of Data Protection Laws and Regulations, and LEX Reception will not execute such instructions until the instruction has been confirmed or modified by Customer to ensure compliance. If LEX Reception processes personal data without Customer's instructions, LEX Reception shall promptly inform Customer to the extent permitted as required by law, regulation, court order or other legal process.
• d) Details of Processing. Customer acknowledges and consents that certain business operations necessary for the fulfillment of the Services hereunder may be transferred in the future to one or more dedicated LEX Reception affiliates or contractors. For sake of clarity, LEX Reception may use Customer's employees' and other personnel's name and work contact information, including without limitation work email, phone, fax or other form of work communication, and other personal data for administrating the contractual relationship, in the capacity of controller, in accordance with LEX Reception's Privacy Policy, a copy of which can be found here. For performing the Services under the Terms and Conditions of Supply, the initial nature and purpose of the Processing, duration of the Processing, categories of data subjects, and types of personal data are set forth in Schedule 1.
• e) Data Breach. LEX Reception shall investigate potential data breaches, and LEX Reception shall notify Customer without undue delay but no less than seventy two (72) hours after becoming aware of a reportable data breach. LEX Reception shall use commercially reasonable steps to stop any further data breach once becoming aware of a potential breach. LEX Reception shall conduct an investigation as to the cause of the incident and shall develop commercially reasonable measures to address the security incident.
• f) Return or Deletion of User Personal Data. Unless otherwise required by applicable Data Protection Laws and Regulations, LEX Reception will destroy or return to Customer its personal data at Customer's request and choice upon termination or expiration of the relevant provisions of the Agreement.

3. Sub-Processors

• a) Use of Sub-processors. Customer agrees that LEX Reception may engage sub-processors who in turn may engage sub-processors to process personal data in accordance with this DPA. A list of sub-processors including their addresses is available upon request. When engaging sub-processors, LEX Reception shall enter into agreements with the sub-processors to bind them to obligations which are substantially similar or more stringent than those set out in this DPA. To the extent required, Customer explicitly mandates LEX Reception to sign such agreements directly with the sub-processors. Customer will not directly communicate with LEX Reception's sub-processors about the Services, unless agreed to by LEX Reception in LEX Reception's sole discretion.
• b) LEX Reception Sub-processors Added After Effective Date. LEX Reception will notify Customer in advance of any changes to sub-processors. If Customer reasonably objects to the addition of a new sub-processors (e.g., such change causes Customer to be noncompliant with applicable with Data Protection Laws and Regulations), Customer shall notify LEX Reception in writing of its specific objections within ten (10) days of receiving such notification. If Customer does not object within such period, the addition of the new sub-processor and, if applicable, the accession to this DPA shall be considered accepted.

4. Representations and Warranties.

Customer represents, warrants, and covenants the following:

• a) The personal data has been collected and transferred to LEX Reception in accordance with the Data Protection Laws and Regulations, and Customer has documented its lawful basis in its public notification to data subjects for processing of personal data, including without limitation LEX Reception's affiliate's and partner's processing of personal data in accordance with the Agreement.
• b) Customer will respond to inquiries from data subjects and from applicable regulatory authorities concerning the processing of the personal data in accordance with Data Protection Laws and Regulations, and will promptly alert LEX Reception of any inquiries from data subjects or from applicable regulatory authorities that relate to LEX Reception's processing of the personal data.
• c) Customer will make available a copy of this DPA to any data subject or regulatory authorities as required by the Data Protection Laws and Regulations.
• d) Customer shall be solely responsible and liable for its compliance with the Data Protection Laws and Regulations.

5. Rights of Data Subjects.

LEX Reception shall, to the extent legally permitted, promptly notify Customer if it receives a request from a data subject for access to, correction, amendment or deletion of such data subject's personal data and, to the extent applicable, LEX Reception shall provide Customer with commercially reasonable cooperation and assistance in relation to any complaint, notice, or communication from a data subject. Customer shall respond to and resolve promptly all requests from data subjects which LEX Reception provides to Customer. If Data Protection Laws and Regulations require LEX Reception to comply with the rights of data subjects or otherwise take any corrective actions without the involvement of Customer, LEX Reception shall take such corrective actions and inform Customer. To the extent legally permitted, Customer shall be responsible for any costs arising from LEX Reception's provision of such assistance.

6. LEX Reception Personnel.

• a) Confidentiality. LEX Reception shall train personnel engaged in the processing of personal data of the confidential nature of the personal data and provide appropriate training based on their responsibilities. LEX Reception shall execute written agreements with its personnel to maintain the confidentiality of personal data.
• b) Limitation of Access. LEX Reception shall use commercially reasonable efforts to limit access to personal data to personnel who require such access to perform the Agreement.
• c) Data Protection Officer. If required by Data Protection Laws and Regulations, LEX Reception shall appoint a data protection officer. Upon request, LEX Reception will provide the contact details of the appointed person.

7. Security.

LEX Reception will implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk posed by the processing of personal data, taking into account the costs of implementation; the nature, scope, context, and purposes of the processing; and the risk of varying likelihood and severity of harm to the data subjects. In assessing the appropriate level of security, LEX Reception shall weigh the risks presented by processing, in particular from accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data transmitted, stored or otherwise processed.

8. Audit Rights.

• a) Audit Requests. Subject to Section 8.c, upon Customer's written request, LEX Reception will provide Customer with the most recent summary audit report(s) concerning the compliance and undertakings in this Agreement. LEX Reception's policy is to share methodology, and executive summary information, but not raw data or private information, other individuals personal data or information not applicable to the Services provided pursuant to the Agreement. LEX Reception will reasonably cooperate with Customer by providing available additional information to help Customer better understand such compliance and undertakings. To the extent it is not possible to otherwise satisfy an audit obligation mandated by applicable Data Protection Laws and Regulations and subject to Section 8.c only the legally mandated entity (such as a governmental regulatory agency having oversight of Customer's operations),a third party auditor mutually agreed to by the parties (as well as a sub-processor subject to a confidentiality agreement, if applicable to the information or facilities being audited), or legally mandated functions within Customer (such as the internal controls function), also subject to a confidentiality agreement, may conduct an onsite visit of the facilities used to deliver the Services. Unless mandated by Data Protection Laws and Regulations or otherwise mandated by law or court order, no audits are allowed within a data centre for security and compliance reasons. After conducting an audit under this Section 8 or after receiving a LEX Reception report under this Section 8, Customer must notify LEX Reception of the specific manner, if any, in which LEX Reception does not comply with any of the security, confidentiality, or data protection obligations in this DPA, if applicable. Any such information will be deemed confidential information of LEX Reception. LEX Reception shall in no circumstances provide Customer with the ability to audit any portion of the Services which would be reasonably expected to compromise the confidentiality of the information or personal data LEX Reception processes for its other customers.
• b) Sub-Processors. Customer may not audit LEX Reception's sub-processors unless required by Data Protection Laws and Regulations. If an audit is required, Customer agrees its requests to audit sub-processors may be satisfied by LEX Reception or LEX Reception's sub-processors presenting up-to-date attestations, reports or extracts from independent bodies, including without limitation external or internal auditors, LEX Reception's data protection officer, the IT security department, data protection or quality auditors or other mutually agreed to third parties, or certification by way of an IT security or data protection audit.
• c) Audit Process. Unless required by Data Protection Laws and Regulations, Customer may request a summary audit report(s) or audit LEX Reception no more than once annually. Customer must provide at least fourteen (14) days prior written notice to LEX Reception of a request for summary audit report(s) or request to audit. The scope of any audit will be limited to LEX Reception's policies, procedures and controls relevant to the protection of Customer's Personal Data as defined in Schedule 1 of this Agreement. Any audit performed under this DPA will be conducted during normal business hours, at LEX Reception's principal place of business or other LEX Reception location(s) where Personal Data is accessed, processed or administered, and will not unreasonably interfere with LEX Reception's day-to-day operations. An audit will be conducted at Customer's sole cost and by a mutually agreed upon third party, and such party must enter into a non-disclosure agreement containing confidentiality provisions substantially similar to those set forth in the Agreement, obligating it to maintain the confidentiality of all LEX Reception’s confidential information and all audit findings. Before the commencement of any such on-site audit, LEX Reception and Customer shall mutually agree upon the timing, and duration of the audit.. Customer shall, at no charge, provide to LEX Reception a full copy of all findings of the audit.

9. Transfers of Personal Data.

Customer acknowledges and agrees that LEX Reception may transfer Customer personal data outside of the UK as reasonably required (at the sole discretion of LEX Reception) in order to provide the Services, provided that LEX Reception shall ensure that all such transfers are effected in accordance with the applicable Data Protection Laws and Regulations. The relevant Standard Contractual Clauses will apply to Customer personal data that is transferred outside United Kingdom, either directly or via onward transfer, to any country not recognised by the United Kingdom as providing an adequate level of protection for personal data. Notwithstanding the foregoing, the Standard Contractual Clauses (or obligations the same as those under the Standard Contractual Clauses) will not apply if LEX Reception has adopted Binding Corporate Rules for Processors or an alternative recognised compliance standard for the lawful transfer of personal data outside the United Kingdom.

10. Limitation of Liability; Third Party Beneficiaries.

Each party's and all of its affiliate's liability, taken together in the aggregate, arising out of or related to this DPA, whether in contract, tort or under any other theory of liability, is subject to the "Limitation of Liability" section of the Agreement, and any reference in such section to the liability of a party means the aggregate liability of that party and all of its affiliates under the Agreement and this DPA. For the avoidance of doubt, LEX Reception's and its affiliate's total liability for all claims from the Customer arising out of or related to the Agreement and each DPA shall apply in the aggregate for all claims under both the Agreement and this DPA. Subject to Section 9, affiliates, partners and users of Customer are not third party beneficiaries under this Agreement.

11. Data Protection Impact Assessment and Prior Consultation.

LEX Reception shall provide commercially reasonable assistance about its Processing of Personal Data to Customer as necessary for Customer to comply under the Data Protection Laws and Regulations with conducting any data protection impact assessments or engaging in required prior consultations with Supervising Authorities (as such term is defined in GDPR).

12. Governing Law

The governing law of this DPA, and the forum for all disputes in respect of this DPA, shall be the same as set out in the Agreement, unless otherwise required by applicable Data Protection Laws and Regulations.