Appendix 1 - Data Processing Agreement

3.1 Data processing by MOBIOOS

Upon conclusion of the Contract, the Customer instructs MOBIOOS to carry out the following processing of personal data under the following conditions:

• Purpose: to provide the License and Services to the Customer;
• Nature of operations: operations necessary for MOBIOOS to provide the License and Services to the Customer;
• Duration of processing: duration of the Contract;
• Categories of data subjects: the Customer and the Users; and,
• Personal data processed: data contained in the Customer's Account or provided by the Users (surname, first name, email, IP addresses, connection data).

Should the Customer wish to change these instructions, the Customer undertakes to inform MOBIOOS in writing.

3.2 MOBIOOS' obligations as a data processor

MOBIOOS undertakes to carry out such processing only in accordance with the documented instructions of the Customer, including with regard to transfers of personal data to a third country or to an international organization, unless it is otherwise obliged to do so under the law of the European Union or of a Member State of the European Union to which it is subject. In such a case MOBIOOS undertakes to inform the Customer of this obligation unless the law from which it derives prohibits it from doing so on important grounds of public interest.

MOBIOOS also undertakes:

• to inform the Customer immediately if it considers that any of its instructions constitute a breach of the data protection regulations;
• to ensure that individuals that are authorized to have access to personal data, alternatively, undertake to respect the confidentiality of the data or are subject to an appropriate legal obligation of confidentiality;
• implementing all reasonable technical and organizational measures to ensure a level of security appropriate to the risk involved in the processing of personal data;
• to forward to the Customer any request from a data subject concerning the processing of their data that is addressed to MOBIOOS;
• to implement technical and organizational measures, taking into account the nature of the processing, in order to assist the Customer, as far as possible, to comply with requests to exercise the rights of the data subjects.

Should the Customer wish MOBIOOS to implement special measures other than those already in place on the date of conclusion of the Contract for the purpose of compliance with data protection regulations, the costs and expenses incurred by MOBIOOS on this occasion shall be borne exclusively by the Customer.

3.3 Subsequent subcontracting

The Customer hereby gives general permission to MOBIOOS to use subcontractors in the implementation of the processing. The Customer hereby agrees that MOBIOOS may use the subcontractors listed at: privacy policy.

Before any addition or change of a subcontractor, MOBIOOS undertakes to inform the Customer in advance by updating the aforementioned list of subcontractors and by sending a notification on the Customer's Account and/or to the email address indicated in the Customer's Account. From the date of the update of the list of subcontractors, the Customer shall have a period of ten (10) days in which to send their comments to MOBIOOS. In the absence of a reply from the Customer or in the event of use of the Platform after this period has expired, the Customer shall be deemed to have agreed to the addition or change of the envisaged subsequent subcontractor.

In the event of an objection that is justified by MOBIOOS' failure to comply with the GDPR and is not raised within the aforementioned ten (10) days period, the Customer may notify MOBIOOS of the termination of the Contract at the end of this period, by sending a letter to MOBIOOS by registered post with acknowledgement of receipt. The Customer shall cease all use of the Platform on expiry of this period.

MOBIOOS undertakes to ensure that the services of any further data processors it uses are governed by a legal instrument placing the same obligations on the subcontractors as those to which it is itself subject under this Appendix. MOBIOOS shall ensure that the technical and organizational measures put in place by its subcontractors comply with the requirements of the GDPR and shall in any event remain fully responsible to the Customer for compliance with their obligations.

3.4 Transfer of data outside the European Union

The Customer is informed and agrees, within the framework of this Appendix, that the personal data entrusted to MOBIOOS may be subject to transfer outside the European Economic Area. The list of data transfers outside the European Economic Area can be found at privacy policy. MOBIOOS has ensured that the necessary instruments have been put in place to ensure that these transfers comply with the GDPR.

3.5 Data upon termination of the Contract

Except when MOBIOOS is subject to a retention obligation under the law of the European Union or one of its Member States, the Customer instructs MOBIOOS to destroy the personal data processed on his behalf and any copies thereof existing on the day of termination of the Contract.

3.6 Assistance and audit of the Customer

MOBIOOS undertakes:

• to assist the Customer in complying with its obligations under Articles 32 to 36 of the GDPR, taking into account the nature of the processing and the information at its disposal;
• to make available to the Customer all information necessary to demonstrate MOBIOOS' compliance with its obligations under this Appendix as well as that necessary for the performance of any audits, whether conducted by the Customer or by any third party commissioned by them.

It is agreed between the Parties that the possible provision of MOBIOOS' personnel for such assistance or in connection with the conduct of an audit shall be charged to the Customer on the basis of an amount of 800 euros per man-day.

The Parties agree that MOBIOOS may only be audited once (1) per calendar year.

3.7 Declaration and guarantee

The Customer declares that they have carried out all necessary and sufficient due diligence and studies to ensure that the implementation of the data processing by MOBIOOS under the Contract complies with the Applicable Data Protection Regulations.

MOBIOOS applies enterprise-grade security standards aligned with SOC 2 and ISO/IEC 27001 frameworks, with formal certification audits -  underway. MOBIOOS's GDPR compliance is also underway. The Customer guarantees that the security measures implemented by MOBIOOS comply with the requirements of the data protection regulations. In this respect, the Customer also guarantees that they have taken the necessary and sufficient steps to ensure that this is the case, in particular an analysis of the level of risk to the rights and freedoms of natural persons arising from the implementation of the processing.