AMENDMENT NO.1 TO THE DPA/AGREEMENT

This amendment No. 1 (this “Amendment”), effective as of January 1^st, 2023 (the “Effective Date”), amends and/or supplements the Data Processing Addendum/Agreement (the “DPA”) incorporated within and/or referenced in the services agreement (the “Agreement”) or signed separately between DT (as defined below) (“DT”) and the entity engaged with DT under the Agreement (“Vendor”). If a DPA was not executed by the parties, this Amendment will amend and supersede the data processing provisions included in the Agreement that address Personal Information Processing in connection with the provision of the Services (as defined below) by Vendor.

The Vendor’s continued to provide DT with the services described in the Agreement (the “Services”) on and following the Effective Date without objection will indicate its agreement to the terms of this Amendment.

Each party to this Amendment may be referred to as a “party” and collectively as the “parties”. All capitalized terms not otherwise defined in this Amendment will have the meanings ascribed to them in the DPA, the Agreement, or Information Privacy Laws (as defined below), as applicable.

NOW THEREFORE, in consideration of the foregoing premises, and the terms and conditions set forth below, the sufficiency of which have been acknowledged by DT and Vendor, the parties agree as follows:

1.          Definitions

“DT’s Personal Information” means as such term, or any similar term referring to Personal Information Processed by Vendor on the DT’s behalf, is defined under the DPA or the Agreement, and to the extent that the Agreement or DPA does not include such term – any Personal Information Processed by Vendor on behalf of the DT as a Service Provider or Processor in connection with the provision of the Services to DT under the Agreement.

“Information Privacy Laws” means as such term or any similar term referring to privacy or data protection laws and regulations as defined under the Agreement, and to the extent that the Agreement does not include such term – all laws and regulations worldwide, which apply to the respective party’s Processing of Personal Information.

“DT” means the relevant entity engaged under the Agreement or DPA and may be one or more of the DT entities listed in Appendix A attached hereto.

“Other Processor” as such term, or any similar term referring to a third-party service provider engaged by Vendor for the purpose of Processing Personal Information on DT’s behalf, is defined under the Agreement, and to the extent that the Agreement does not include such term – any third-party service provider engaged by Vendor for the purpose of Processing DT’s Personal Information on behalf of DT.

“Individual” means as such term, or any similar term referring to a natural person who is the subject of the DT’s Personal Information as defined under the Agreement, and to the extent that the Agreement does not include such term – as such term or any similar term referring to such a person is defined under Information Privacy Laws.

“Personal Information” means as such term or any similar term referring to information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular Individual or household, and to the extent that the Agreement does not include such term – as such term or any similar term referring to such information is defined under Information Privacy Laws.

2.          Modifications to the DPA. To the extent required under Information Privacy Laws, the following provisions are added to the DPA or the Agreement, as applicable, and where a provision (or a substantially similar provision) already exists under the DPA or the Agreement, as applicable, the following provisions will replace it:

DT and Vendor acknowledge that: (A) DT’s Personal Information is disclosed to Vendor only for the following limited Business Purpose of Vendor providing DT with the Services (the “Purpose”); and (B) DT is not Selling DT’s Personal Information to Vendor.

DT will notify Vendor of any valid request received from an Individual pursuant to Information Privacy Laws that Vendor must comply with and will provide all information necessary for Vendor to comply with such a request.

Vendor will: (A) comply with all provisions under Information Privacy Laws applicable to Vendor, including with respect to providing the same level of protection to DT’s Personal Information as required under Information Privacy Laws; and (B) notify DT no later than within five (5) business days after determining that Vendor can no longer meet its obligations under Information Privacy Laws with respect to the DT’s Personal Information.

Vendor will not: (A) Sell DT’s Personal Information; (B) Share (within the meaning thereof under Information Privacy Laws) DT’s Personal Information other than with Vendor’s Other Processors in accordance with the Agreement; and/or ,provisions of the DPA (as applicable); (C) unless otherwise permitted under Information Privacy Laws, retain, use, or disclose DT’s Personal information: (i) for any purposes other than those specified under the Agreement or DPA (as applicable); (ii) for any commercial purpose other than the Purpose, including in providing services to other customers of Vendor; or, (iii) outside the direct business relationship between DT and Vendor.

DT may: (A) take reasonable and appropriate steps to ensure that Vendor uses DT’s Personal Information in a manner consistent with DT’s obligations under Information Privacy Laws; and (B) upon notice, take reasonable and appropriate steps to stop and remediate Vendor’s unauthorized use of DT’s Personal Information.

3.          Except as expressly provided herein, the terms and provisions of the DPA or the Agreement and/or DPA, as applicable, shall remain in full force and effect.

APPENDIX A