1. 1.Definitions

   1. The definitions used in this Addendum shall have the meanings set forth in this Addendum. Capitalized definitions not otherwise defined herein shall have the meaning given to them in the Service Agreement. Except as modified or supplemented below, the definitions of the Service Agreement, as well as all the other terms and conditions of the Service Agreement, shall remain in full force and effect.

   2. For the purpose of interpreting this Addendum, the following terms shall have the meanings set out below:

      • "Applicable Laws" means (i) European Union or Member State laws with respect to any Client Personal Data in respect of which the Client is subject to EU Data Protection Laws; and (ii) any other applicable law with respect to any Client Personal Data in respect of which the Client is subject to any other Data Protection Laws;
      • "Client" means the Client, as defined in the Service Agreement, including all affiliates of that entity, if any;
      • "Client Personal Data" means any Personal Data Processed by Surveybot or a Subprocessor on behalf of the Client pursuant to or in connection with the Service Agreement;
      • "Contracted Processor" means Surveybot, a Subprocessor, or both collectively;
      • "Data Protection Laws" means EU Data Protection Laws and, to the extent applicable, the data protection or privacy laws of any other country;
      • "EU Data Protection Laws" means EU Directive 95/46/EC, as transposed into domestic legislation of each Member State and as amended, replaced or superseded from time to time, including by the GDPR and laws implementing or supplementing the GDPR;
      • "GDPR" means EU General Data Protection Regulation 2016/679;
      • “Restricted Transfer” means any transfer of Client Personal Data that would be prohibited by EU Data Protection Laws (or by the terms of data transfer agreements put in place to address the data transfer restrictions of EU Data Protection Laws) in the absence of the execution of the Standard Contractual Clauses or another lawful data transfer mechanism, as set out in Section 12 below;
      • "Services" means the services and other activities to be supplied to or carried out by or on behalf of Surveybot for the Client pursuant to the Service Agreement; and
      • "Subprocessor" means any person (including any third party, but excluding an employee of Surveybot or an employee of any of its sub-contractors) appointed by or on behalf of Surveybot to Process Personal Data on behalf of the Client in connection with the Service Agreement.

   3. The terms, "Controller", "Data Subject", "Rights of the Data Subject(s)", "Member State", "Personal Data", "Personal Data Breach", all forms of the verb "Process", “Processor”, "Supervisory Authority", and "Third Country", whether capitalized or not, shall have the same meaning as in the GDPR, and their cognate terms shall be construed accordingly.

2. 2.Applicability

   1. This Addendum will not apply to the processing of Client Personal Data, where such processing is not regulated by EU Data Protection Laws. The Parties to this Addendum hereby agree that the terms and conditions set out herein shall be added as an addendum to the Service Agreement. Except where the context requires otherwise, references in this Addendum to the Service Agreement are to the Service Agreement as amended or supplemented by, and including, this Addendum.

   2. This Addendum shall enter into force and effect on the Effective Date (as defined in the Service Agreement).

3. 3.Processing of Client Personal Data

   1. In the context of this Addendum, the Client acts as a data controller and Surveybot acts as a data processor with regard to the Processing of Client Personal Data.

   2. Surveybot warrants that it will:

      • comply with all applicable Data Protection Laws in the Processing of Client Personal Data;
      • not Process Client Personal Data other than on the Client’s relevant documented instructions, including with regard to transfers of personal data to a third country or an international organization, unless such Processing is required by Applicable Laws to which the relevant Contracted Processor is subject, in which case Surveybot shall to the extent permitted by Applicable Laws inform the Client of that legal requirement before the respective act of Processing of that Personal Data; and
      • only transfer Client Personal Data outside the European Economic Area (EEA), where such transfers are regulated by EU Data Protection Laws, in compliance with EU Data Protection Laws.

   3. The Client instructs Surveybot (and authorizes Surveybot to instruct each Subprocessor) to Process Client Personal Data, and to transfer Client Personal Data to those countries or territories where those Subprocessors identified in Exhibit B are located, consistent with the Service Agreement and the present Addendum. In the event that in Surveybot’s opinion a Processing instruction given by the Client may infringe Applicable Laws, Surveybot shall immediately inform the Client upon becoming aware of such a Processing instruction.

4. 4.Surveybot Personnel

   1. Surveybot shall take reasonable steps to ensure the reliability of any employee, agent, or contractor of any Contracted Processor who may have access to the Client Personal Data, ensuring in each case that access is strictly limited to those individuals who need to know or access the relevant Client Personal Data, as strictly necessary for the purposes of the Service Agreement, and to comply with Applicable Laws in the context of that individual's duties to the Contracted Processor, ensuring that all such individuals are subject to formal confidentiality undertakings or professional or statutory obligations of confidentiality.

5. 5.Security of Processing

   1. Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of Processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, Surveybot shall, with regard to Client Personal Data, implement and maintain appropriate technical and organizational security measures to ensure a level of security appropriate to that risk, including, as appropriate, the measures referred to in Article 32(1) of the GDPR.

   2. In assessing the appropriate level of security, Surveybot shall take account in particular of the risks that are presented by the nature of such Processing activities, and particularly those related to possible Personal Data Breaches.

6. 6.Subprocessing

   1. The Client authorizes Surveybot to appoint (and permit each Subprocessor appointed in accordance with this Section 6 to appoint) Subprocessors in accordance with this Section 6 and any possible further restrictions, as set out in the Service Agreement.

   2. Surveybot may continue to use those Subprocessors already engaged by Surveybot as of the date of this Addendum, subject to Surveybot meeting the obligations set out in Section 6.4. The list of current Surveybot Subprocessors is set out in Exhibit B to this Addendum.

   3. Surveybot shall give the Client prior written notice of the appointment of any new Subprocessor, by way of sending notice e-mails to the Client, including full details of the Processing to be undertaken by that respective Subprocessor. If within 10 days of receipt of each such notice e-mail, the Client does not explicitly notify Surveybot in writing of any objections (on reasonable grounds) to the proposed appointment, it shall be deemed that the Client has consented to the proposed appointment.

   4. With respect to each Subprocessor, Surveybot shall:

      • before the Subprocessor first Processes Client Personal Data (or, where relevant, in accordance with Section 6.2), carry out adequate due diligence to ensure that the Subprocessor is capable of providing the level of protection for Client Personal Data required by the present Addendum, the Service Agreement, and EU Data Protection Laws; and
      • ensure that the arrangement between: on the one hand, (i) Surveybot, or (ii) the relevant intermediate Subprocessor; and on the other hand, the respective envisaged Subprocessor, is governed by a written contract including terms which offer at least the same level of protection for Client Personal Data as those set out in this Addendum, and that such terms meet the requirements of Article 28(3) of the GDPR.

7. 7.Rights of the Data Subjects

   1. Taking into account the nature of the Processing, Surveybot shall assist the Client by implementing appropriate technical and organizational measures, insofar as this is possible, for the fulfilment of the Client's obligations, as reasonably understood by the Client, to respond to requests to exercise Rights of the Data Subjects under the Data Protection Laws.

   2. With regard to Rights of the Data Subjects within the scope of this Section 7, Surveybot shall:

      • cpromptly notify the Client if any Contracted Processor receives a request from a Data Subject under any Data Protection Law in respect of Client Personal Data; and
      • ensure that the Contracted Processor does not respond to that request except on the documented instructions of the Client, or as required by Applicable Laws to which the Contracted Processor is subject, in which case Surveybot shall, to the extent permitted by Applicable Laws, inform the Client of that legal requirement before the Contracted Processor responds to the request.

8. 8.Personal Data Breach

   1. Surveybot shall notify the Client without undue delay upon Surveybot or any Subprocessor becoming aware of a Personal Data Breach affecting Client Personal Data, providing the Client with sufficient information to allow the Client to meet any obligations pursuant to the Data Protection Laws to report to the Supervisory Authorities and/or inform the Data Subjects of the Personal Data Breach.

   2. Surveybot shall co-operate with the Client and take all reasonable commercial steps to assist the Client in the investigation, mitigation, and remediation of each such Personal Data Breach.

   3. Surveybot’s notification of or response to a Personal Data Breach under this Section 8 will not be construed as an acknowledgement by Surveybot of any fault or liability with respect to the Personal Data Breach

9. 9.Data Protection Impact Assessment and Prior Consultation

   1. Surveybot shall provide the Client with relevant documentation (upon a written request and subject to obligations of confidentiality), with regard to any data protection impact assessments, and prior consultations with Supervising Authorities or other competent data privacy authorities, when the Client reasonably considers that such data protection impact assessments or prior consultations are required pursuant to Article 35 or 36 of the GDPR or pursuant to the equivalent provisions of any other Data Protection Law, but in each such case solely with regard to Processing of Client Personal Data by, and taking into account the nature of the Processing and information available to, the respective Contracted Processors.

10. 10.Deletion or Return of Client Personal Data

    1. Surveybot shall provide the Client with the means to request the deletion of Client Personal Data within the term of this Addendum and the Service Agreement, unless Applicable Laws require retention of any such Client Personal Data.

11. 11.Audit Rights

    1. Where the Client is entitled to and desires to review Surveybot’s compliance with the EU Data Protection Laws, the Client may request, and Surveybot will provide (subject to obligations of confidentiality) any available audit report. If the Client, after having reviewed such audit report(s), still reasonably deems that it requires additional information, Surveybot shall further reasonably assist and make available to the Client, upon a written request and subject to obligations of confidentiality, all other information and/or documentation necessary to demonstrate compliance with this Addendum, and the obligations pursuant to Articles 32 to 36 of the GDPR in particular, and shall allow for and contribute to audits, including remote inspections of the Services, by the Client or an auditor mandated by the Client with regard to the Processing of the Client Personal Data by the Contracted Processors.

12. 12.Restricted Transfers

    1. The Client (as “data exporter”) and Surveybot (as “data importer”) hereby enter into, as of the Addendum Effective Date, the

       Standard Contractual Clauses, which are incorporated by this reference and constitute an integral part of this Addendum. The Parties are deemed to have accepted and executed the Standard Contractual Clauses in their entirety, including the appendices.

    2. With regard to any Restricted Transfer from the Client to Surveybot within the scope of this Addendum, one of the following transfer mechanisms shall apply, in the following order of precedence

       • the Standard Contractual Clauses (insofar the prospective Restricted Transfer would be considered lawful under this mechanism); or
       • any other lawful basis, as laid down in EU Data Protection Laws, as the case may be.

    3. Where Surveybot has appointed or will appoint a Subprocessor and no other lawful basis or derogation for Restricted Transfers under EU Data Protection Laws applies, Surveybot shall use Standard Contractual Clauses as the transfer mechanism for Restricted Transfers with that respective Subprocessor.

    4. In cases where the Standard Contractual Clauses apply, and there is a conflict between the terms of the Addendum and the terms of the Standard Contractual Clauses, the terms of the Standard Contractual Clauses shall control.

13. 13.General Terms

    1. All clauses of the Service Agreement, that are not explicitly amended or supplemented by the clauses of this Addendum, and as long as this does not contradict with compulsory requirements of Applicable Laws under this Addendum, remain in full force and effect and shall apply, including, but not limited to: Governing Law and Dispute Resolution, Jurisdiction, Limitation of Liability (to the maximum extent permitted by Applicable Laws).

    2. Should any provision of this Addendum be found invalid or unenforceable pursuant to any applicable law, then the invalid or unenforceable provision will be deemed superseded by a valid, enforceable provision that most closely matches the intent of the original provision and the remainder of the Addendum will continue in effect.

    3. If Surveybot makes a determination that it can no longer meet its obligations in accordance with this Addendum, it shall promptly notify the Client of that determination, and cease the Processing or take other reasonable and appropriate steps to remediate.

Exhibit A

1. 1. Pursuant to Article 28(3) of the GDPR, further details of the Processing, in addition to the ones laid down in the Service Agreement and this Addendum, include:

   1. The subject matter of the Processing of Client Personal Data is:

      • The subject matter of the Processing of Client Personal Data pertains to the provision of Services, as requested by the Client.

   2. The duration of the Processing of Client Personal Data is:

      • The duration of the Processing of Client Personal Data is generally determined by the Client and is subject to the term of this Addendum and the Service Agreement, respectively, in the context of the contractual relationship between Surveybot and the Client.

   3. The obligations and rights of the Client are:

      • The rights and obligations of the Client are set out in the Service Agreement and this Addendum.

Exhibit B

1. Pursuant to Art. 6.2 of the Addendum, below is a list of Surveybot’s current Subprocessors as of the Effective Date:

   Subprocessor Name	Location of Processing
   Google LLC	United States of America
   Amazon Web Services, Inc.	United States of America
   Atlassian	Australia
   Mailgun	USA
   Intercom	USA
   Circle CI	USA
   SolarWinds	USA
   Facebook	USA
   Facebook Workplace	USA
   JICT Ventures Inc.	Canada