This Data Processing Addendum ("DPA") forms part of the agreement between ADT Nederland B.V. ("Processor", "Dhi ADT", "we", "us"), Queens Towers, Delflandlaan 1, 1062 EA Amsterdam, The Netherlands (KvK: 76553426 · VAT: NL860671707B01), and the customer entering into a services agreement with Dhi ADT ("Controller", Customer, "you"), and governs the processing of Personal Data in connection with the Employer of Record, Global Payroll, Immigration, and HR services provided by Dhi ADT (the "Services").

1. Purpose & Scope

This DPA is intended to satisfy the requirements of Article 28 of the General Data Protection Regulation (EU) 2016/679 ("EU GDPR"), the UK GDPR, the Swiss Federal Act on Data Protection ("Swiss FADP"), and other applicable data protection laws (together, "Data Protection Laws"). It forms part of, and is incorporated into, the Master Services Agreement, EOR Agreement, or Payroll Services Agreement between the parties (the "Main Agreement"). Where this DPA conflicts with the Main Agreement on data protection matters, this DPA prevails (see Section 10.2, Order of Precedence).

2. Definitions

Terms not otherwise defined in this DPA have the meanings given to them in Data Protection Laws. In particular:

3. Processing of Personal Data

3.1 Instructions

Dhi ADT shall process Personal Data only on documented instructions from the Controller, including with regard to transfers of Personal Data to a third country, unless required to do so by applicable law. In such a case, Dhi ADT shall inform the Controller of that legal requirement before processing, unless that law prohibits this on important grounds of public interest.

3.2 Confidentiality

Dhi ADT ensures that persons authorised to process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

3.3 Nature and Purpose of Processing

Dhi ADT processes Personal Data for the purpose of providing Employer of Record, Global Payroll, Immigration, and HR services to the Controller, for the duration of the Main Agreement, on behalf of the categories of Data Subjects (Employees, Contractors, and Client representatives) and in respect of the categories of Personal Data reasonably necessary to deliver those Services, as further described in the Main Agreement.

4. Sub-processors

4.1 Authorisation

The Controller provides Dhi ADT with general written authorisation to engage Sub-processors to process Personal Data in connection with the Services, provided that Dhi ADT imposes data protection obligations on each Sub-processor that are no less protective than those set out in this DPA.

4.2 Notification of Changes

Dhi ADT shall notify the Controller of any intended changes to the list of Sub-processors — whether additions or replacements — giving the Controller at least 30 days' prior written notice. The Controller may object to any new Sub-processor within 14 days of receiving notice on reasonable data-protection grounds. If the Controller objects and the parties cannot resolve the issue, either party may terminate the affected Service with 30 days' written notice, without penalty, limited to the affected Service.

4.3 Sub-processor Liability

Where a Sub-processor fails to fulfil its data protection obligations, Dhi ADT shall remain fully liable to the Controller for the performance of that Sub-processor's obligations. The current approved Sub-processor list is maintained at adtsolution.com/sub-processors and is available to Controllers on request.

5. International Data Transfers

5.1 Transfers within the EU/EEA

Personal Data processed by Dhi ADT under this DPA is, where possible, hosted within the European Economic Area (EEA). Intra-EEA transfers are conducted within the GDPR framework and require no additional safeguards.

5.2 Transfers to Third Countries

Where Personal Data is transferred outside the EEA, UK, or Switzerland to a country not benefiting from an adequacy decision, Dhi ADT shall ensure such transfer is subject to appropriate safeguards, including the Standard Contractual Clauses, and shall implement supplementary measures where required by a transfer impact assessment.

5.3 UK and Swiss Transfers

For transfers subject to UK GDPR, the parties shall rely on the UK International Data Transfer Addendum to the EU SCCs. For transfers subject to Swiss FADP, the parties shall apply the SCCs as adapted for Switzerland, including recognition of the Swiss Federal Data Protection and Information Commissioner (FDPIC) as supervisory authority where applicable.

5.4 Incorporation by Reference

The SCCs (including the UK IDTA and Swiss FADP variations, as applicable) are incorporated into this DPA by reference and shall apply automatically to any relevant transfer of Personal Data under this DPA, without requiring further execution by the parties, to the extent such transfer requires a transfer mechanism under Data Protection Laws.

6. Data Subject Rights

Taking into account the nature of the processing, Dhi ADT shall assist the Controller, insofar as possible, by appropriate technical and organisational measures, for the fulfilment of the Controller's obligation to respond to requests from Data Subjects exercising their rights under Data Protection Laws (including access, rectification, erasure, restriction, portability, and objection). Where Dhi ADT receives a Data Subject request directly and can identify the relevant Controller, it will promptly redirect the request to the Controller and will not itself respond substantively unless legally required or authorised by the Controller to do so.

7. Security Measures

Dhi ADT shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, taking into account the state of the art, costs of implementation, and the nature, scope, context, and purposes of processing, including as applicable: encryption of Personal Data in transit and at rest, network isolation, role-based access controls, single sign-on for internal systems, continuous access auditing, regular security and privacy training, daily backups, and auditable logging of access and changes to production systems. A full technical and organisational measures summary is available to Controllers on request. Dhi ADT will review and update these measures periodically to reflect its actual operational environment.

8. Personal Data Breach Notification

Dhi ADT shall notify the Controller without undue delay, and in any event within 48 hours of becoming aware, after becoming aware of a Personal Data Breach affecting the Controller's Personal Data. Such notification shall include, to the extent then known, the nature of the breach, categories and approximate number of Data Subjects and records concerned, likely consequences, and measures taken or proposed to address the breach. Dhi ADT shall cooperate with the Controller and take reasonable steps to assist in the investigation, mitigation, and remediation of the breach.

9. Audit Rights

Dhi ADT shall make available to the Controller all information reasonably necessary to demonstrate compliance with this DPA and shall allow for, and contribute to, audits, including inspections, conducted by the Controller or an auditor mandated by the Controller, subject to reasonable advance notice, confidentiality obligations, and no more than once per 12-month period unless required by a supervisory authority or following a Personal Data Breach.

10. General Provisions

10.1 Liability

Each party's liability arising out of or related to this DPA is subject to the liability limitations and exclusions set out in the Main Agreement.

10.2 Order of Precedence

In the event of a conflict between the terms of this DPA and the Main Agreement, this DPA shall prevail with respect to the parties' data protection obligations. In the event of a conflict between this DPA and the SCCs, the SCCs shall prevail.

10.3 Governing Law and Jurisdiction

This DPA shall be governed by the laws of the Netherlands, without regard to its conflict of laws principles, and the courts of Amsterdam, the Netherlands shall have exclusive jurisdiction, unless the SCCs specify otherwise for matters within their scope.

10.4 Severability

If any provision of this DPA is held invalid or unenforceable, the remaining provisions shall remain in full force and effect, and the invalid provision shall be replaced with a valid provision that most closely reflects the original intent.

10.5 Amendments

Dhi ADT may update this DPA from time to time to reflect changes in Data Protection Laws or its processing operations, provided that such updates do not materially reduce the level of protection afforded to Personal Data. Material changes will be notified to the Controller in advance.