Xitricon limited data protection addendum

This Data Protection Addendum (“Addendum”) is entered into between Xitricon Limited (“Xitricon”) and [Customer full legal name], a company registered in [country] under company number [number], whose registered office is at [registered address] (“Customer”). This Addendum forms part of the [name of agreement, e.g. Master Services Agreement] dated [date] between Xitricon and Customer, or such other written agreement incorporating this Addendum, in each case governing the provision of the Services to Customer (the “Agreement”). This Addendum was last updated in October 2026.

Customer enters into this Addendum on behalf of itself and any Affiliates authorized to use the Services under the Agreement that have not entered into a separate contractual arrangement with Xitricon.

For the purposes of this Addendum only, and except where otherwise indicated, references to “Customer” shall include Customer and such Affiliates.

Xitricon and Customer (each a “Party” and together the “Parties”) hereby agree that the terms and conditions set out below shall be added as an Addendum to the Agreement.

1. Definitions

1.1 In this Addendum, the following terms shall have the meanings set out below and cognate terms shall be construed accordingly:

(a) “Affiliate” means an entity that owns or controls, is owned or controlled by, or is under common control or ownership with either Customer or Xitricon (as the context allows), where control is defined as the possession, directly or indirectly, of the power to direct or cause the direction of the management and policies of an entity, whether through ownership of voting securities, by contract or otherwise;

b) “Customer Personal Data” means any Personal Data provided or made available by Customer to Xitricon, or collected by Xitricon on behalf of Customer, which is Processed by Xitricon to perform the Services;

(c) “Controller to Processor SCCs” means, as applicable: (i) the standard contractual clauses for the transfer of Personal Data to Third Countries set out in the Annex to European Commission Implementing Decision (EU) 2021/914 of 4 June 2021 (the “EU SCCs”), including as recognised by the Swiss Federal Data Protection and Information Commissioner (“Swiss FDPIC”) for transfers of Personal Data from Switzerland; (ii) the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner’s Office (“UK ICO”) for transfers of Personal Data from the United Kingdom to Third Countries (the “UK Addendum”); or (iii) any similar clauses adopted by a data protection regulator relating to transfers of Personal Data to Third Countries, including without limitation any successor clauses thereto;

(d) “Data Protection Laws” means any local, state, or national law regarding the Processing of Personal Data applicable to Xitricon in the jurisdictions in which the Services are provided to Customer, including, without limitation, privacy, security, and data protection laws and EU Area Law;

(e) “EU Area” means the European Union, the European Economic Area, the United Kingdom, and Switzerland;

(f) “EU Area Law” means (i) Regulation (EU) 2016/679 (the “EU GDPR”) together with applicable legislation implementing or supplementing the same or otherwise relating to the Processing of Personal Data of natural persons; (ii) the EU GDPR as retained in the law of the United Kingdom by virtue of section 3 of the European Union (Withdrawal) Act 2018 (the “UK GDPR”) and the UK Data Protection Act 2018; (iii) the Swiss Federal Act on Data Protection of 25 September 2020 and its Ordinance (the “Swiss DPA”); (iv) any other law relating to the data protection, security, or privacy of individuals that applies in the EU Area; and (v) any successor legislation or amendments to any of the foregoing (including, without limitation, implementation of the EU GDPR by Member States into their national law). References in this Addendum to the “GDPR” mean the EU GDPR and/or the UK GDPR, as applicable;

(g) “Restricted Transfer” means a transfer of Customer Personal Data from the EU Area to a Third Country which, in the absence of an adequacy decision or an appropriate safeguard, would be prohibited by EU Area Law;

(h) “Security Incident” means any breach of security that leads to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of, or access to, Customer Personal Data being Processed by Xitricon;

(i) “Services” means the services to be supplied by Xitricon to Customer or Customer’s Affiliates pursuant to the Agreement; and

(j) “Third Country” means any country that, where required by applicable Data Protection Laws, has not received an adequacy decision from an applicable authority relating to cross-border transfers of Personal Data, including regulators such as the European Commission, the UK ICO, or the Swiss FDPIC.

1.2 The terms “Controller”, “Data Subject”, “Personal Data”, “Personal Data Breach”, “Process”, “Processor”, “Sub-processor”, and “Supervisory Authority” have the meanings given to them in applicable Data Protection Laws, and cognate terms shall be construed accordingly.

1.3 Capitalized terms not otherwise defined in this Addendum shall have the meanings ascribed to them in the Agreement.

2. Scope of Addendum

2.1 This Addendum applies to Xitricon’s Processing of Customer Personal Data under the Agreement to the extent such Processing is subject to Data Protection Laws. This Addendum is governed by the governing law of the Agreement unless otherwise required by Data Protection Laws.

3. Roles of the Parties

3.1 The Parties acknowledge and agree that, with regard to the Processing of Customer Personal Data, and as more fully described in Annex 1 hereto, Customer acts as a Controller and Xitricon acts as a Processor. This Addendum shall apply solely to the Processing of Customer Personal Data by Xitricon acting as a Processor or Sub-processor.

3.2 The Parties expressly agree that Customer shall be solely responsible for ensuring timely communications to Customer’s Affiliates or the relevant Controller(s) who receive the Services, insofar as such communications may be required or useful in light of applicable Data Protection Laws to enable Customer’s Affiliates or the relevant Controller(s) to comply with such laws.

3.3 Customer is solely responsible for complying with Security Incident notification laws applicable to Customer and for fulfilling any obligations to give notices to government authorities, affected individuals or others relating to any Security Incidents.

3.4 Xitricon does not host, own or operate Customer’s IFS environments. Such environments are either operated by Customer or provided to Customer by IFS or another hosting provider under a separate agreement between Customer and that provider. Accordingly: (a) IFS and any such hosting provider are engaged directly by Customer and are not Sub-processors of Xitricon, and Xitricon shall have no responsibility or liability for their acts or omissions; and (b) Customer is responsible (directly or through its contract with the relevant provider) for the security, availability, backup and recovery of such environments, and for provisioning, reviewing and revoking any access granted to Xitricon personnel. Xitricon’s obligations under this Addendum in respect of such environments are limited to Xitricon’s own acts and omissions when accessing them.

4. Description and Purpose of Personal Data Processing

4.1 In Annex 1 to this Addendum, the Parties have mutually set out their understanding of the subject matter and details of the Processing of the Customer Personal Data to be Processed by Xitricon pursuant to this Addendum. The Parties may make reasonable amendments to Annex 1 by mutual written agreement as reasonably necessary to reflect changes to the Services or to address the requirements of Data Protection Laws from time to time. Save for Section 4 of Annex 1 (Technical and Organisational Security Measures), which forms part of Xitricon’s obligations under Section 5.2(e), Annex 1 is descriptive and does not create any obligations or rights for any Party.

4.2 The purpose of Processing under this Addendum is the provision of the Services pursuant to the Agreement and any Order Form(s) or Statement(s) of Work.

5. Data Processing Terms

5.1 Customer shall comply with all applicable Data Protection Laws in connection with the performance of this Addendum and the Processing of Customer Personal Data. In connection with its access to and use of the Services, Customer shall Process Customer Personal Data within such Services and provide Xitricon with instructions in accordance with applicable Data Protection Laws. As between the Parties, Customer shall be solely responsible for compliance with applicable Data Protection Laws regarding the collection of Customer Personal Data and its transfer to Xitricon. Customer agrees not to provide Xitricon with any special categories of Personal Data as defined in Article 9 of the GDPR (including data concerning a natural person’s health or religious beliefs).

5.2 Xitricon shall comply with all applicable Data Protection Laws in the Processing of Customer Personal Data and shall Process Customer Personal Data only for the purposes of the Agreement and the specific purposes set out in Annex 1 to this Addendum, and otherwise solely on the documented instructions of Customer. The Agreement, this Addendum, and Customer’s use of the Services’ features and functionality are Customer’s documented instructions to Xitricon in relation to the Processing of Customer Personal Data. In particular:

(a) Xitricon shall use, retain, disclose, or otherwise Process Customer Personal Data only on behalf of Customer, for the specific purpose of providing the Services, and in accordance with Customer’s instructions, including as described in the Agreement. Xitricon shall not sell Customer Personal Data, nor use, retain, disclose, or otherwise Process Customer Personal Data outside of its business relationship with Customer or for any other purpose (including Xitricon’s own commercial purposes), except as required or permitted by law. Xitricon shall immediately inform Customer:

(i) iif Xitricon determines that it is no longer able to meet its obligations under Data Protection Laws; or

(ii) if, in Xitricon’s opinion, an instruction infringes applicable Data Protection Laws.
Customer reserves the right to take reasonable and appropriate steps to ensure that Xitricon’s Processing of Customer Personal Data is consistent with Customer’s obligations under Data Protection Laws, and to stop and remediate any unauthorized use of Customer Personal Data;

(b) Xitricon may Process Customer Personal Data solely:

(i) to the extent necessary to (A) perform its obligations under the Agreement; (B) maintain and support the Services; and/or (C) protect the Services or Customer Personal Data from a threat;

(ii) if required by an order of a court or an authorized governmental agency, provided that, to the extent legally permissible, prior notice is first given to Customer in accordance with Section 5.2(g); or

(iii) as otherwise expressly authorized by Customer;

(c) Xitricon shall not combine Customer Personal Data which it Processes on Customer’s behalf with Personal Data which it receives from or on behalf of another person or persons, or collects from its own interaction with individuals, provided that Xitricon may combine Customer Personal Data where necessary to perform the Services as permitted or required under the Agreement;

(d) Xitricon shall implement and maintain measures designed to ensure that Xitricon personnel authorized to Process the Customer Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, unless disclosure is required by law or professional regulations;

(e)Xitricon shall implement and maintain the technical and organizational measures set out in Section 4 of Annex 1 and, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of Processing, as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, implement and maintain any further commercially reasonable and appropriate administrative, technical, and organizational measures designed to ensure a level of security appropriate to the risk of the Processing of Customer Personal Data in accordance with Article 32 of the GDPR, including, as appropriate and in respect of systems under Xitricon’s control:

(i) pseudonymization and encryption of Customer Personal Data;

(ii) ensuring the ongoing confidentiality, integrity, availability and resilience of Xitricon’s processing systems and services that Process Customer Personal Data;

(iii) restoring the availability of and access to Customer Personal Data in a timely manner in the event of a physical or technical incident; and

(iv) regularly testing, assessing and evaluating the effectiveness of technical and organizational measures for ensuring the security of the Processing of Customer Personal Data;

(f) Customer hereby agrees that Xitricon is generally authorized to engage and appoint Sub-processors, subject to Xitricon:

(i) making its current list of Sub-processors available to Customer upon request;

(ii) notifying Customer at least thirty (30) calendar days in advance of any intended changes or additions to its Sub-processors by emailing notice of the intended change to Customer;

(iii) including data protection obligations in its contract with each Sub-processor that are materially the same as those set out in this Addendum; and

(iv) remaining liable to Customer for any failure by each Sub-processor to fulfil its obligations in relation to the Processing of the Customer Personal Data.

In relation to any notice received under Section 5.2(f)(ii), Customer shall have a period of thirty (30) days from the date of the notice to inform Xitricon in writing of any reasonable objection on data protection grounds to the use of that Sub-processor. The Parties will then, for a period of no more than thirty (30) days from the date of Customer’s objection, work together in good faith to attempt to find a commercially reasonable solution for Customer which avoids the use of the objected-to Sub-processor. Where no such solution can be found, either Party may (notwithstanding anything to the contrary in the Agreement) terminate only that part of the Services which cannot be provided without the objected-to Sub-processor, on written notice to the other Party, without damages, penalty or indemnification whatsoever (but without prejudice to any fees incurred by Customer prior to termination);

(g) Xitricon shall, to the extent legally permissible, promptly notify Customer of any legally binding request (e.g., a disclosure required by law, court order, or subpoena) for disclosure of Customer Personal Data. Where a request is not legally binding, Xitricon shall not disclose the Customer Personal Data and shall notify Customer that the request has been rejected. Xitricon shall maintain a record of all legally binding disclosure requests relating to Customer Personal Data;

(h) Xitricon shall, to the extent legally permissible, promptly notify Customer of any communication from a Data Subject regarding the Processing of Customer Personal Data, or any other communication (including from a Supervisory Authority) relating to any obligation under applicable Data Protection Laws in respect of the Customer Personal Data. Xitricon will not respond to any such request or complaint unless expressly authorized to do so by Customer or otherwise required to respond under applicable Data Protection Laws. Taking into account the nature of the Processing, Xitricon will reasonably assist Customer (or the relevant Controller) by appropriate technical and organizational measures, insofar as this is possible, in the fulfilment of Customer’s, Customer’s Affiliates’ or the relevant Controller(s)’ obligation to respond to requests for exercising the Data Subject’s rights laid down in Chapter III of the GDPR. Customer agrees to pay Xitricon for time and for out-of-pocket expenses incurred by Xitricon in connection with the performance of its obligations under this Section 5.2(h);

(i) Upon becoming aware of a Security Incident, Xitricon shall notify Customer without undue delay and in any event within seventy-two (72) hours, such notice to include, to the extent reasonably available to Xitricon, all timely information reasonably required by Customer (or the relevant Controller) to comply with its data breach reporting obligations under applicable Data Protection Laws. Xitricon shall further take reasonable measures and actions within its control to remedy or mitigate the effects of such Security Incident, the costs of which shall be borne by the Party whose breach of this Addendum caused the Security Incident, and shall keep Customer reasonably informed of developments concerning the Security Incident. Customer acknowledges that Xitricon’s notification of a Security Incident is not an acknowledgement by Xitricon of its fault or liability. Security Incidents do not include unsuccessful attempts or activities that do not compromise the security of Customer Personal Data, including unsuccessful login attempts, pings, port scans, denial of service attacks or other network attacks on firewalls or networked systems;

(j) Xitricon shall, to the extent required by applicable Data Protection Laws, provide reasonable assistance to Customer, Customer’s Affiliates or the relevant Controller(s) with their obligations pursuant to Articles 32 to 36 of the GDPR, taking into account the nature of the Processing and the information available to Xitricon. Customer agrees to pay Xitricon for time and for out-of-pocket expenses incurred by Xitricon in connection with any assistance provided in connection with Articles 35 and 36 of the GDPR;

(k) Upon the termination or expiry of the Agreement, Xitricon shall cease Processing the Customer Personal Data. Customer Personal Data (including data migration files) is held within Customer’s environments and storage locations, remains under Customer’s control, and Customer shall revoke Xitricon’s access to them. Within thirty (30) days, Xitricon shall delete any incidental copies of Customer Personal Data that have come into its possession in accordance with Section 12.4, unless (and solely to the extent and for such period as) applicable law requires Xitricon to retain them, and shall, on Customer’s written request, certify such deletion in writing. Any Customer Personal Data retained shall remain subject to the obligations of confidentiality set forth in the Agreement;

(l) Xitricon shall maintain the records necessary to demonstrate compliance with its obligations under this Addendum in respect of the Processing of Customer Personal Data carried out on behalf of Customer; and

(m) Xitricon shall make available to Customer all information reasonably necessary to demonstrate compliance with this Addendum and shall allow for and contribute to audits, including inspections, conducted by Customer or an independent third-party auditor mandated by Customer, subject to the following:

(i) in the first instance, Xitricon will demonstrate compliance by providing its ISO/IEC 27001 certificate, relevant summaries of third-party audit reports and responses to reasonable cybersecurity and other assessments, and Customer shall only request an inspection where it cannot reasonably establish Xitricon’s compliance from such information;

(ii) audits and inspections shall take place no more than once in any twelve (12) month period, unless required by a competent Supervisory Authority or following a Security Incident affecting Customer Personal Data that was caused by Xitricon;

(iii) Customer shall give at least thirty (30) days’ prior written notice (or such shorter period as a competent Supervisory Authority may require), agree the scope of the audit with Xitricon in advance, and conduct the audit during Xitricon’s normal business hours, for no more than two (2) business days on-site, and in a manner that avoids unnecessary disruption to Xitricon’s operations;

(iv) any third-party auditor shall not be a competitor of Xitricon and shall be bound by written confidentiality obligations no less protective than those set out in the Agreement;

(v) Customer shall treat all information obtained in the course of an audit as Xitricon’s confidential information and use it solely to verify Xitricon’s compliance with this Addendum; and

(vi) Customer shall bear its own costs of any audit and shall pay Xitricon for its time and out-of-pocket expenses incurred in connection with such audits and responses to cybersecurity and other assessments, in accordance with Section 5.5.

5.3 Artificial Intelligence. Xitricon shall not input, upload or otherwise Process Customer Personal Data using any artificial intelligence or machine learning tools, and shall not use Customer Personal Data to train, retrain or improve any artificial intelligence or machine learning model, whether Xitricon’s own or a third party’s. Any change to this position shall require a written amendment to this Addendum agreed by both Parties.

5.4 Access Minimisation. Xitricon’s approach is to restrict access to Customer Personal Data to the greatest extent practicable. Accordingly, Xitricon shall:

(a) access Customer Personal Data only where strictly necessary to deliver the Services and, wherever practicable, perform the Services using anonymised, pseudonymised or masked data;

(b) access Customer’s systems containing Customer Personal Data only through user accounts or access methods provided or approved by Customer, which Customer may suspend or revoke at any time;

(c) restrict such access to named, authorized Xitricon personnel, to the minimum Customer Personal Data required for the relevant task, and to the period necessary to complete that task; and

(d) cooperate with Customer in reviewing logs of Xitricon personnel’s access to Customer Personal Data maintained within Customer’s environments, and maintain records of the Xitricon personnel granted such access.

5.5 Charges for Assistance. Where this Addendum provides that Customer shall pay for Xitricon’s time and out-of-pocket expenses, such time shall be charged at the rates set out in [clause / schedule reference] of the Agreement (or, where no such rates are set out, at Xitricon’s then-current standard professional services rates), and out-of-pocket expenses shall be charged at cost.

5.6 Instructions Outside the Scope of the Services. Any instruction from Customer regarding the Processing of Customer Personal Data that goes beyond the scope of the Services agreed in the Agreement shall be dealt with under the change control procedure set out in [clause reference] of the Agreement, and Xitricon shall be entitled to charge for implementing it. Xitricon shall not be obliged to implement such an instruction until the relevant change has been agreed, save where the instruction is necessary for Customer to comply with Data Protection Laws, in which case Xitricon shall implement it and the Parties shall agree the associated charges in good faith.

6. Warranties

6.1 The Parties warrant that they, and any of their staff and/or subcontractors, will comply with their respective obligations under Data Protection Laws for the term of the Agreement.

6.2 Customer warrants and represents that: (a) it has, and will maintain, a lawful basis under Data Protection Laws for the Processing of Customer Personal Data by Xitricon in accordance with this Addendum; (b) it has provided all notices to, and obtained all consents from, Data Subjects that are required for such Processing; (c) its instructions to Xitricon comply with Data Protection Laws; and (d) it is entitled to disclose and make available the Customer Personal Data to Xitricon for the purposes of the Services.

7. Restricted Transfers

7.1 The Parties agree that where the transfer of Customer Personal Data from Customer and/or any of its Affiliates (as data exporter) to Xitricon (as data importer) is a Restricted Transfer, the transfer shall be subject to the appropriate Controller to Processor SCCs, which shall be deemed incorporated into and form part of this Addendum as follows:

(a) In relation to Customer Personal Data that is protected by the EU GDPR and Processed by Xitricon on behalf of and under the instruction of Customer, the EU SCCs will apply, completed as follows:

(i) Module Two will apply (controller to processor transfers);

(ii) in Clause 7, the optional docking clause will apply;

(iii) in Clause 9, Option 2 will apply, and the time period for prior notice of Sub-processor changes shall be as set out in Section 5.2(f) of this Addendum;

(iv) in Clause 11, the optional language will not apply;

(v) in Clause 17, Option 1 will apply, and the EU SCCs will be governed by Irish law;

(vi) in Clause 18(b), disputes shall be resolved before the courts of the Republic of Ireland;

(vii) Annex I of the EU SCCs shall be deemed completed with the information set out in Annex 1 to this Addendum; and

(viii) Annex II of the EU SCCs shall be deemed completed with the information set out in Section 4 of Annex 1 to this Addendum.

(b) In relation to Customer Personal Data that is protected by the Swiss DPA, the EU SCCs shall apply in accordance with Section 7.1(a) of this Addendum, but with the following modifications:

(i) any references in the EU SCCs to “Regulation (EU) 2016/679” shall be interpreted as references to the Swiss DPA and the equivalent articles or sections therein;

(ii) any references to “EU”, “Union”, “Member State”, and “Member State law” shall be interpreted as references to Switzerland and Swiss law, as the case may be;

(iii) any references to the “competent supervisory authority” and “competent courts” shall be interpreted as references to the Swiss FDPIC and the competent courts in Switzerland; and

(iv) the EU SCCs, as so modified, shall be governed by the laws of Switzerland, and disputes shall be resolved before the competent Swiss courts.

(c) In relation to Customer Personal Data that is protected by the UK GDPR, the EU SCCs shall apply in accordance with Section 7.1(a) of this Addendum, but as modified and interpreted by Part 2 (Mandatory Clauses) of the UK Addendum, which shall be incorporated into and form an integral part of this Addendum. Any conflict between the terms of the EU SCCs and the UK Addendum shall be resolved in accordance with Sections 10 and 11 of the UK Addendum. In addition, Tables 1 to 3 in Part 1 of the UK Addendum shall be deemed completed with the information set out in Annex 1 to this Addendum, and Table 4 in Part 1 of the UK Addendum shall be deemed completed by selecting both “Importer” and “Exporter”.

7.2 Xitricon shall not participate in any other Restricted Transfer of Customer Personal Data (whether as an importer or an exporter of the Customer Personal Data) unless the Restricted Transfer is made in compliance with applicable Data Protection Laws and pursuant to the relevant Controller to Processor SCCs or other Transfer Mechanism (as defined in Section 8.1) implemented between the relevant exporter and importer of the Customer Personal Data.


7.3 Customer, as data exporter, shall routinely review all international transfers of Customer Personal Data on a case-by-case basis in order to monitor new risks arising from changes in local laws, data practices or similar factors, and shall implement additional safeguards (such as encryption or pseudonymization) to mitigate identified risks and ensure that the Customer Personal Data remains protected to the standard required under Data Protection Laws.

8. Transfer Mechanism

8.1 Where a Party located in a Third Country receives Customer Personal Data from the EU Area: (a) that Party will act as the data importer; (b) the other Party will act as the data exporter; and (c) the relevant Transfer Mechanism will apply. “Transfer Mechanism” means any lawful means of transferring Personal Data from the EU Area to a Third Country in compliance with applicable Data Protection Laws. This may include, but is not limited to, the following:

(i) the EU SCCs (as amended or replaced from time to time);

(ii) the International Data Transfer Agreement issued by the UK ICO under section 119A of the UK Data Protection Act 2018, in force from 21 March 2022; and

(iii) the UK Addendum issued by the UK ICO under section 119A of the UK Data Protection Act 2018, in force from 21 March 2022.

8.2 Additional measures. If the Transfer Mechanism is insufficient to safeguard the transferred Personal Data, the data importer will promptly implement such commercially reasonable supplementary measures as the Parties agree, acting in good faith, to ensure that the Personal Data is protected to the standard required under Data Protection Laws. If the Parties cannot agree such measures, or the agreed measures cannot reasonably be implemented, the data exporter may suspend the relevant transfer, and either Party may terminate the affected part of the Services on written notice without liability to the other Party (but without prejudice to any fees incurred prior to termination).

8.3 Disclosures. Subject to the terms of the relevant Transfer Mechanism, if the data importer receives a request from a public authority to access Personal Data, it will (if legally permitted) promptly notify the data exporter of the request, challenge the request where it has reasonable grounds to consider it unlawful, disclose only the minimum amount of Personal Data required, and keep a record of the disclosure.

9. Precedence

9.1 The provisions of this Addendum are supplemental to the provisions of the Agreement. In the event of any inconsistency between the provisions of this Addendum and the provisions of the Agreement, the following order of priority shall apply: (a) the Controller to Processor SCCs or any other Transfer Mechanism agreed by the Parties; (b) this Addendum; and (c) the Agreement. Accordingly, in the event that any provision of this Addendum and/or the Agreement contradicts, directly or indirectly, the Controller to Processor SCCs, the Controller to Processor SCCs will prevail.

10. Liability and Indemnity

10.1 Indemnity. To the extent permissible by law, each Party (the “Indemnifying Party”) shall (a) defend the other Party and its Affiliates (collectively, the “Indemnified Parties”) from and against any and all claims, demands, suits, or proceedings made or brought against any of the Indemnified Parties by any third party, including any Supervisory Authority (each, a “Claim”), and (b) indemnify and hold harmless the Indemnified Parties from and against any and all losses, damages, liabilities, fines and administrative fines (to the extent such fines are lawfully indemnifiable), penalties, settlements, and reasonable costs and expenses (including reasonable legal, investigatory and consultancy fees and expenses) incurred or suffered by any of the Indemnified Parties, in each case to the extent caused by any breach by the Indemnifying Party of this Addendum or of its obligations under applicable Data Protection Laws. The Indemnifying Party’s liability under this Section 10.1 shall be reduced proportionately to the extent that the relevant loss was caused or contributed to by any act or omission of the Indemnified Parties.

10.2 Conduct of Claims. The Indemnified Parties shall (a) promptly notify the Indemnifying Party in writing of any Claim; (b) allow the Indemnifying Party sole control of the defense and settlement of the Claim, provided that the Indemnifying Party shall not settle any Claim in a manner that imposes any liability or admission on the Indemnified Parties without their prior written consent (not to be unreasonably withheld); and (c) provide reasonable cooperation at the Indemnifying Party’s expense. The Indemnified Parties may participate in the defense and/or settlement of a Claim with counsel of their choosing at their own expense.

10.3 Limitation of Liability. Subject to Section 10.6, each Party’s total aggregate liability arising out of or in connection with this Addendum (including under Section 10.1), whether in contract, tort (including negligence), breach of statutory duty or otherwise, shall be subject to the limitations and exclusions of liability set out in clause [clause number] (Limitation of Liability) of the Agreement and shall not in any event exceed [amount, e.g. an amount equal to the total fees paid or payable under the Agreement in the twelve (12) months preceding the event giving rise to the claim] (the “Data Protection Cap”). The Data Protection Cap forms part of, and is not in addition to, the aggregate liability cap set out in the Agreement. This Section 10.3 applies notwithstanding any provision of the Agreement that excludes data protection, confidentiality or indemnity obligations from the limitations of liability set out in the Agreement.

10.4 Excluded Losses. Subject to Section 10.6, neither Party shall be liable to the other under or in connection with this Addendum for any loss of profits, revenue, business, goodwill or anticipated savings, or for any indirect, special or consequential loss, in each case as further set out in clause [clause number] of the Agreement.

10.5 Affiliates. Any claim by a Customer Affiliate under or in connection with this Addendum shall be brought by Customer on that Affiliate’s behalf, and the liability of Xitricon and its Affiliates to Customer and all of Customer’s Affiliates shall be aggregated and subject to the Data Protection Cap as if it were liability to Customer alone.

10.6 Unlimited Liability. Nothing in this Addendum shall limit or exclude either Party’s liability (a) for death or personal injury caused by its negligence, fraud or fraudulent misrepresentation, or any other liability which cannot be limited or excluded by applicable law; or (b) to Data Subjects under the Controller to Processor SCCs or Article 82 of the GDPR, to the extent such liability cannot be limited by contract.

10.7 Mitigation. Each Party shall take reasonable steps to mitigate any loss, damage, cost or expense for which it may seek to recover from the other Party under this Addendum.

10.8 Exclusions. Xitricon shall not be liable under this Addendum for any loss, Security Incident or non-compliance to the extent that it results from (a) Xitricon’s compliance with Customer’s instructions; (b) any act or omission of Customer, its Affiliates or their personnel, contractors or other suppliers (other than Xitricon and its Sub-processors); or (c) any vulnerability in, or failure of, systems or environments not controlled by Xitricon, except to the extent caused by Xitricon’s breach of this Addendum.

11. Severability

11.1 The Parties agree that if any section or sub-section of this Addendum is held by any court or competent authority to be unlawful or unenforceable, it shall not invalidate or render unenforceable any other section of this Addendum.

12. Miscellaneous

12.1 This Addendum is designed to address the following:

(a) privacy by design and by default;
(b) security of Processing;
(c) support for the notification of Security Incidents to the relevant Supervisory Authority;
(d) notification of Security Incidents to Customer;
(e) conducting data protection (privacy) impact assessments where appropriate and required by applicable Data Protection Laws; and
(f) Xitricon’s assistance where prior consultation with the relevant Supervisory Authority is required by applicable Data Protection Laws.

12.2 Xitricon shall comply with applicable Data Protection Laws (including the GDPR) in its Processing of Customer Personal Data, shall maintain an information security management system certified to ISO/IEC 27001:2022, and shall operate its privacy information management practices in alignment with ISO/IEC 27701.

12.3 As Xitricon acts as a Processor, Data Subjects should direct requests to exercise their rights under applicable Data Protection Laws, and any concerns or complaints about the Processing of their Personal Data, to Customer as Controller. Any such request or complaint received by Xitricon shall be handled in accordance with Section 5.2(h). Customer may contact Xitricon’s Data Protection Officer (“DPO”) in relation to this Addendum using the details below, as updated by Xitricon from time to time by written notice to Customer:

Name: Muhammed Naseer
Email ID: Muhammed.Naseer@xitricon.com

12.4 Xitricon does not store Customer Personal Data on Xitricon systems as part of the Services. Data migration files and any other files containing Customer Personal Data shall be created and held only in storage locations provided and controlled by Customer (or by IFS on Customer’s behalf). Where a copy of Customer Personal Data incidentally comes into Xitricon’s possession (for example, as an attachment to a support request), Xitricon shall use it only for the purpose for which it was provided, shall not retain it longer than necessary, and shall securely delete it promptly thereafter.

12.5 This Addendum shall remain in force for so long as Xitricon Processes Customer Personal Data on behalf of Customer, notwithstanding the termination or expiry of the Agreement. Sections 5.2(k), 10, 11 and 12 shall survive termination or expiry of this Addendum.

12.6 If a change in Data Protection Laws, or a decision of a competent Supervisory Authority or court, requires an amendment to this Addendum (including the adoption of replacement standard contractual clauses), the Parties shall negotiate the necessary amendment in good faith. Any additional costs to Xitricon of implementing such an amendment shall be dealt with under the change control procedure in the Agreement.

Signatures This Addendum has been executed by the duly authorized representatives of the Parties on the dates set out below.

Annex 1 to Data Protection Addendum

Description of Processing Activities for Customer Personal Data

This Annex sets out certain details of the Processing of Customer Personal Data by Xitricon in connection with the Services.

1. List of Parties

Data Exporter

Data Importer

2. Competent Supervisory Authority

3. Processing Information

4. Technical and Organisational Security Measures

Description of the technical and organisational security measures implemented by Xitricon as the data processor/data importer to ensure an appropriate level of security, taking into account the nature, scope, context, and purpose of the Processing, and the risks to the rights and freedoms of natural persons.

Security

Security Management System.

• Organization. Xitricon designates qualified security personnel whose responsibilities include development, implementation, and ongoing maintenance of the Information Security Program.

• Policies. Management reviews and supports all security-related policies to ensure the security, availability, integrity and confidentiality of Customer Personal Data. These policies are updated at least once annually.

• Assessments.Xitricon engages a reputable independent third party to perform risk assessments of Xitricon’s information systems at least once annually.

• Risk Treatment.Xitricon maintains a formal and effective risk treatment program that includes penetration testing, vulnerability management and patch management to identify and protect against potential threats to the security, integrity or confidentiality of Customer Personal Data.

•Vendor Management. Xitricon maintains an effective vendor management program.

•Incident Management. Xitricon reviews security incidents regularly, including effective determination of root cause and corrective action.

•Standards. Xitricon operates an information security management system certified to ISO/IEC 27001:2022.

Personnel Security.

• Xitricon personnel are required to conduct themselves in a manner consistent with the company’s guidelines regarding confidentiality, business ethics, appropriate usage, and professional standards. Xitricon conducts reasonably appropriate background checks on any employees who will have access to Customer Personal Data under the Agreement, including in relation to employment history and criminal records, to the extent legally permissible and in accordance with applicable local labor law, customary practice and statutory regulations.

• Personnel are required to execute a written confidentiality agreement at the time of hire and to protect Customer Personal Data at all times. Personnel must acknowledge receipt of, and compliance with, Xitricon’s confidentiality, privacy and security policies. Personnel are provided with privacy and security training on how to implement and comply with the Information Security Program. Personnel handling Customer Personal Data are required to complete additional requirements appropriate to their role (e.g., certifications). Xitricon’s personnel will not Process Customer Personal Data without authorization.

Access Controls

• Access Management. Xitricon maintains a formal access management process for the request, review, approval and provisioning of all personnel with access to Customer Personal Data, to limit access to Customer Personal Data and to systems storing, accessing or transmitting Customer Personal Data to properly authorized persons having a need for such access. Access reviews are conducted periodically to ensure that only those personnel who still require access to Customer Personal Data retain it.

• Infrastructure Security Personnel. Xitricon has, and maintains, a security policy for its personnel, and requires security training as part of the training package for its personnel. Xitricon’s infrastructure security personnel are responsible for the ongoing monitoring of Xitricon’s security infrastructure and responding to security incidents.

• Access Control and Privilege Management. Xitricon personnel must authenticate via a multi-factor authentication system or a single sign-on system to access Xitricon systems used in providing the Services. Access to Customer’s systems is subject to Customer’s own access controls in accordance with Section 5.4 of this Addendum.

• Internal Data Access Processes and Policies – Access Policy.Xitricon’s internal data access processes and policies are designed to protect against unauthorized access, use, disclosure, alteration or destruction of Customer Personal Data. Xitricon designs its systems to allow authorized persons to access only the data they are authorized to access, based on the principles of “least privilege” and “need to know”, and to prevent others who should not have access from obtaining access. Xitricon requires the use of unique user IDs, strong passwords, multi-factor authentication and carefully monitored access lists to minimize the potential for unauthorized account use. The granting or modification of access rights is based on the authorized personnel’s job responsibilities, the job duty requirements necessary to perform authorized tasks, and a need-to-know basis, and must be in accordance with Xitricon’s internal data access policies and training. Approvals are managed by workflow tools that maintain audit records of all changes. Access to systems is logged to create an audit trail for accountability. Where passwords are employed for authentication (e.g., login to workstations), password policies follow industry-standard practices, including password complexity, password expiry, password lockout, restrictions on password reuse and re-prompting for a password after a period of inactivity.

Customer Environments

• Hosting. Xitricon does not host Customer’s IFS environment(s). The physical, infrastructure and network security, resilience, backup and disaster recovery of those environments are provided by Customer or by IFS (or another hosting provider) under their own arrangements with Customer.

• Access. Xitricon personnel access Customer’s environments only through accounts and access methods provided or approved by Customer, in accordance with Section 5.4 of this Addendum. Data migration files are created and held in storage locations provided and controlled by Customer, and Xitricon personnel do not download or retain copies of Customer Personal Data on Xitricon systems.

Xitricon Systems and Devices

• Infrastructure. Xitricon’s corporate systems are hosted on Microsoft Azure.

• End-user Devices. Xitricon devices used to access Customer’s environments are centrally managed, protected by endpoint security software and full-disk encryption, and kept up to date with security patches.

• Security Logs. Xitricon’s systems have logging enabled to support security audits and to monitor and detect actual and attempted attacks on, or intrusions into, Xitricon’s systems.

• Vulnerability Management. Xitricon performs regular vulnerability scans of its systems. Vulnerabilities are remediated on a risk basis, with Critical, High and Medium security patches installed as soon as commercially practicable.

• Encryption Technologies. Xitricon uses encrypted connections (TLS or equivalent) when accessing Customer’s environments and storage locations.

• Incident Response. Xitricon maintains incident management policies and procedures, including detailed security incident escalation procedures. Xitricon monitors a variety of communication channels for security incidents, and Xitricon’s security personnel will react promptly to suspected or known incidents, mitigate the harmful effects of such security incidents, and document such security incidents and their outcomes.

Data Storage

Customer Personal Data, including data migration files, is Processed and stored only within Customer’s environments and storage locations provided and controlled by Customer (or by IFS on Customer’s behalf). Xitricon does not store Customer Personal Data on Xitricon systems. Any incidental copy that comes into Xitricon’s possession is handled and deleted in accordance with Section 12.4 of this Addendum.