Clari Data Processing Addendum 2025

a) Compliance with Laws. Customer is responsible for complying with all Data Protection Laws with respect to its Processing of Personal Data. Customer is solely responsible for: (i) the accuracy, quality and legality of Personal Data and the means by which Customer acquired Personal Data; and (ii) ensuring that Customer's Instructions to Clari regarding the Processing of Personal Data comply with applicable laws, including Data Protection Laws. Customer will inform Clari without undue delay if Customer is not able to comply with its responsibilities under this DPA, including Data Protection Laws. Customer shall not provide or make available to Clari any Personal Data in violation of the Agreement or otherwise inappropriate for the nature of the Services.

b) Customer Instructions. The parties agree that the Agreement, together with Customer's use of the Services in accordance with the Agreement, constitute Customer's Instructions to Clari in relation to the Processing of Personal Data. The subject matter, nature, purpose, and duration of this Processing, as well as the types of Personal Data collected and categories of Data Subjects, are described in Annex 1 to this DPA.

a) Compliance with Instructions. Clari will Process Personal Data only: (i) for the purposes described in the Agreement and this DPA; (ii) in accordance with any other reasonable Instructions provided by Customer in accordance with this DPA and the Agreement; and (iii) as required by Data Protection Laws or a supervisory authority. Clari shall immediately notify Customer if an instruction, in Clari's opinion, infringes Data Protection Laws or instructions of a supervisory authority.

b) Use of Personal Data. Clari shall not: (i) sell or share Personal Data; (ii) retain, use, or disclose Personal Data outside of Clari's direct business relationship with Customer or for any purpose other than for a business purpose under the CCPA on behalf of Customer or as necessary to perform the Services for Customer pursuant to the Agreement, except as otherwise permitted in the Agreement or by Data Protection Laws; and (iii) combine Personal Data received from, or on behalf of, Customer with Personal Data that it receives from, or on behalf of, another party or person, except as necessary to provide the Services or as otherwise instructed by Customer.

c) Security. Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of Processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, Clari will implement and maintain appropriate technical and organizational measures to ensure a level of security appropriate to the risk of Processing Personal Data, as described in Annex 2 to this DPA.

d) Confidentiality. Clari will take commercially reasonable steps to: (i) ensure the reliability and appropriate training of any personnel whom Clari authorizes to Process Personal Data on Clari's behalf ("Authorized Personnel"); (ii) ensure that Authorized Personnel are subject to a confidentiality agreement that prevents the processing of Personal Data, both during and after their engagement by Clari, except in accordance with their obligations in connection with the Services; and (iii) limit access to Personal Data only to Authorized Personnel.

e) Personal Data Breaches. Clari will notify Customer without undue delay, but in no event more than seventy-two (72) hours, after Clari becomes aware of any Personal Data Breach and take such steps as Clari deems necessary and reasonable to remediate such Personal Data Breach. Clari's notification shall include (to the extent known): (i) the nature of the Personal Data Breach including, where possible, the categories and approximate number of Data Subjects and the categories and approximate number of Personal Data records concerned; (ii) the name and contact details of the data protection officer or other contact point where more information can be obtained; (iii) the likely consequences of the Personal Data Breach; and (iv) the measures taken or proposed to be taken by Clari to address the Personal Data Breach, where appropriate, measures to mitigate its possible adverse effects.

f) Deletion or Return of Personal Data. Within ninety (90) days following the expiration or termination of the Subscription Term, Clari will return or delete the Personal Data, except as required to be retained by applicable laws. If return or destruction is impracticable or prohibited by law, rule or regulation, Clari shall take measures to block such Personal Data from any further processing (except to the extent necessary for its continued hosting or processing required by law, rule or regulation) and shall continue to appropriately protect the Personal Data remaining in its possession, custody, or control. If Customer and Clari have entered into Standard Contractual Clauses, the parties agree that the certification of deletion of Personal Data that is described in Clause 8.1(d) and Clause 8.5 of the EU SCCs (as applicable) shall be provided by Clari to Customer only upon Customer's request.

a) Taking into account the nature of the Services, Clari offers Customer controls that Customer can use to comply with its obligations to respond to requests from Data Subjects under Data Protection Laws ("Data Subject Requests"). Where a Data Subject Request is made directly to Clari, Clari will either advise the Data Subject to submit their request to Customer or forward that request to Customer. Customer will be responsible for responding to such request.

b) To the extent that Customer is unable to independently address a Data Subject Request through the Services, then upon Customer's written request Clari will provide reasonable assistance to Customer to respond to any Data Subject Requests relating to the Processing of Personal Data under the Agreement.

a) Clari engages the Sub-Processors listed in Annex 3 of this DPA (the "List") to Process Personal Data on Customer's behalf in connection with the Services. The Sub-Processors included on the List as of the Effective Date are approved by Customer, constituting Customer's prior written consent to Clari's sub-processing of the Processing of Personal Data. If Clari intends to add a new Sub-Processor to the List after the Effective Date, it will provide written notice to Customer of such intention (via email). Customer will have thirty (30) days from such notice to object to the newly proposed Sub-Processor. Objection must be based on reasonable data protection grounds. If no objection is provided within such period, the Sub-Processor is deemed approved by Customer. If Customer provides an objection within such period, the parties will, for a period of ten (10) days after such objection, discuss the issue diligently and in good faith. If they cannot agree on a workaround or alternative within such period, Customer's sole remedy is to terminate the Agreement on written notice to Clari.

b) Clari will ensure that it imposes data protection terms on the Sub-Processors that provide a substantially similar level of protection for Personal Data as those set out in this DPA. Clari will remain responsible for each Sub-Processor's compliance with the obligations of this DPA and for any acts or omissions of such Sub-Processor to the same extent that Clari would itself be liable under this DPA had it conducted such acts or omissions.

a) Restricted Transfers. For the purposes of Processing Personal Data under the Agreement, Customer shall be regarded as the Controller, and Clari shall be regarded as the Processor. The parties agree that Clari and its Sub-Processors may make international transfers of Personal Data Processed under this DPA, including outside the EEA, the UK, or Switzerland as necessary to provide the Services, and in accordance with Data Protection Laws. To the extent Clari Processes any Customer Personal Data subject to the EU GDPR or UK GDPR under the Agreement, any such transfer will be subject to: (i) the Data Privacy Framework; or (ii) if the Data Privacy Framework is unavailable, the EU SCCs or UK SCCs, as applicable and as set forth under Section 6(b) and 6(d) below.

b) Transfers from the EEA. With respect to Customer Personal Data transferred from the European Economic Area ("EEA") pursuant to the Standard Contractual Clauses (if the Data Privacy Framework is unavailable), the EU SCCs incorporated herein shall apply, form part of this DPA, and take precedence over the rest of this DPA as set forth in the EU SCCs. They will be deemed completed as follows:

c) Transfers from Switzerland. The Parties agree that transfers from Switzerland shall either be made pursuant to: (i) the Data Privacy Framework, or (ii) if the Data Privacy Framework is unavailable, the EU SCCs with the following modifications:

d) Transfers from the UK. With respect to Personal Data transferred from the United Kingdom for which United Kingdom law (and not the law in any EEA jurisdiction) governs the international nature of the transfer and a data transfer mechanism is required, such transfers shall be made pursuant to: (i) the Data Privacy Framework, or (ii) if the Data Privacy Framework is unavailable, the UK SCCs, which are deemed entered into and incorporated into this DPA by reference. Undefined capitalized terms used in this provision shall have the definitions set forth in the UK SCCs.

e) Statutory Revisions to the EU SCCs or UK SCCs. In the event that the EU GDPR or UK GDPR require the use of revised standard contractual clauses applicable to this DPA, such revised standard contractual clauses shall automatically be deemed to replace the EU SCCs and/or UK SCCs, as applicable, without the need for any further action, unless Clari otherwise informs Customer.

f) Data Protection Impact Assessments and Consultation with Supervisory Authorities. To the extent required by Data Protection Laws, Clari will provide reasonable assistance to Customer with any data protection impact assessments and prior consultations with supervisory authorities.

a) Clari will maintain records sufficient to demonstrate its compliance with its obligations under this DPA and retain such records for a period of three (3) years after the expiration or termination of the Subscription Term ("Compliance Documentation"). Clari also uses external auditors to verify the adequacy of its security measures. This audit (a) will be performed at least annually; (b) will be performed according to ISO 27001 standards or substantially equivalent standards; (c) will be performed by independent third-party security professionals at Clari's selection and expense; and (d) will result in the generation of a confidential audit report ("Audit Report"). Upon Customer's request, no more than once per year, Clari will provide (on a confidential basis) Customer with a summary of the Compliance Documentation and Audit Reports so that Customer can verify Clari's compliance with this DPA.

b) To the extent Customer's audit requirements under the Standard Contractual Clauses or Data Protection Laws cannot reasonably be satisfied through Section 7(a) above, Customer may conduct an audit of Clari's systems and facilities solely to verify compliance with this DPA. Any such audit shall be conducted not more than once per calendar year and upon thirty (30) days' prior written notice to Clari. Customer agrees to exercise any such right only through use of an independent, accredited third-party audit firm that is reasonably acceptable to Clari. The audit will occur during Clari's regular business hours and shall not unreasonably interfere with Clari's business. The auditor(s) may be required to execute reasonable confidentiality obligations with Clari. Before the commencement of the audit, Customer and Clari will mutually agree upon the scope, timing, duration, control and evidence requirements for the audit, provided that this requirement to agree will not permit Clari to unreasonably delay performance of the audit. Customer will be responsible for the expenses of any such audits or inspections. If the audit report generated as a result of Customer's audit includes any finding of material non-compliance with this DPA, Customer will share such audit report with Clari and, after Clari's verification of the issue, Clari will promptly cure the non-compliance. If Customer and Clari have entered into Standard Contractual Clauses as described in Section 6 (Cross-Border Data Transfers), the Parties agree that the audits described in Clause 8.9 of the EU SCCs shall be carried out in accordance with this Section 7.

a) Limitation of Liability. The limitations of liability contained in the Agreement shall apply to this DPA.

b) Governing Law. This DPA will be governed in accordance with the choice of jurisdiction stipulated in the Agreement, unless required otherwise by Data Protection Laws.