This Supplier Data Processing Addendum (“DPA”) is made effective as of the date of platform initial access (“DPA Effective Date”) by the entity identified as “Customer” and the entity identified as Arnica (“Supplier”), supplements all contracts effective between Supplier and Customer (whether made before or after the DPA Effective Date, and referred to both individually and collectively as the “Agreement”), is incorporated into the Agreement by reference and supersedes any conflicting or inconsistent provision in the Agreement, will remain in effect for so long as Supplier or its affiliates or Authorized Personnel Process Customer Data.  Attached to and part of this DPA: Exhibit 1: Security Standards. This DPA is a contract binding on the Supplier (as processor to Customer) that sets out the subject-matter and duration of the Processing, the nature and purpose of the Processing, the types of Personal Data and categories of Data Subjects, and Customer’s obligations and rights as controller.

1.   Definitions. In this DPA:
1.1 “Authorized Personnel” means a person who is an employee or a contractor (or other contingent worker) of Supplier or Supplier’s affiliates or subcontractors, to whom Supplier makes Customer Data available (either by permitting or facilitating such person’s access to Customer Data, or by actively communicating or otherwise disclosing Customer Data to such person) in order for Supplier to perform its obligations under the Agreement.
1.2 “Data Subject” means an identified or identifiable natural person, device, or household.
1.3 “Information Security Program” means Supplier’s administrative, physical, and technical safeguards that ensure the confidentiality, integrity, and availability of Customer Data and that take into account the state of the art for information security, costs of implementation, and the nature, scope, context, and purposes of the Processing. Supplier’s Information Security Program contains components substantially similar to those set forth in Exhibit 1.
1.4 “InternationalTransfer” means a transfer of Personal Data originating in one country for Processing in another country.
1.5 “Legal Requirement(s)” means any and all national, federal, state, provincial, local and foreign laws, statutes, ordinances, administrative, executive, or judicial orders, rules, standards, and regulations, including those pertaining to the cross-border transfer of Personal Data (as may be amended from time to time).
1.6 “Customer Confidential (Restricted) Data” is a subset of Customer Data and means highly confidential data and information that Customer provides to Supplier from time to time for which unauthorized use, disclosure, or loss could (i) result in substantial risk of harm or loss (such as significant loss of strategic business advantage or significant financial loss) or (ii) subject Customer (or the owner of the information who entrusted it to Customer) to significant legal liability (such as violation of insider trading laws or other securities laws).  Examples of Customer Confidential (Restricted) Data include: preliminary operating results; trade secrets; product source code, technical drawings; manufacturing and financial strategies; strategic long-range plans; operating plans; or information related to business development activities related to mergers and acquisitions, divestitures, or other restructuring activities.
1.7 “Customer Data” means data Supplier receives from Customer that consists of Customer Confidential (Restricted) Data or Personal Data (or both).
1.8 “Personal Data” is a subset of Customer Data and means information relating to, identifying, or capable of being associated with, a Data Subject.
1.9 “Process(ing)” means to perform any operation or set of operations on Customer Data (whether or not by automated means), such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission or dissemination (or otherwise making available), alignment or combination, restriction, erasure or destruction.
1.10   “Security Incident” means any access to, or destruction, loss, alteration, disclosure, or acquisition of, Customer Data that is not expressly permitted by the Agreement or this DPA.
1.11   “Services” means the provision of products to Customer and/or any services or other work Supplier performs for Customer under the Agreement.
1.12   “Sub-Processor” means a subcontractor or other service provider to Supplier that Processes Personal Data under contract with Supplier in furtherance of Supplier’s performance of Services for Customer.

2.   Supplier’s Obligations.  In addition to Supplier’s confidentiality obligations under the Agreement, Supplier will comply with the requirements stated in this DPA whenever Supplier Processes Customer Data, and in particular whenever Supplier Processes Personal Data as part of Supplier’s Processing of Customer Data.
2.1 Supplier will comply with all Legal Requirements that apply to its Processing of Customer Data.
2.2 Supplier will Process Customer Data (including in any aggregate form) only to provide the Services, only as permitted or required by the Agreement and this DPA, and only in accordance with Customer’s documented instructions (or those of Customer’s customer, where applicable).  
2.3 Supplier will immediately notify Customer if, in Supplier’s opinion, a Processing instruction provided by Customer violates an applicable Legal Requirement.  
2.4 Supplier will maintain appropriate administrative, physical, and technical safeguards that ensure the confidentiality, integrity, and availability of Customer Data.  Where the Processing involves Personal Data, Supplier’s Information Security Program will ensure the protection of the rights of the Data Subject, and Supplier will periodically review and update these measures to ensure continued compliance with all Legal Requirements.
2.5 Supplier will promptly (i) respond to inquiries from Customer related to Supplier’s Information Security Program and compliance with any Legal Requirements and (ii) make available to Customer all information necessary to demonstrate Supplier’s compliance with the obligations of any Legal Requirements (Customer may provide this information to its customer(s), if applicable).
2.6 Supplier will use reasonable efforts to require all Authorized Personnel (or ensure that such persons are required) to be bound by written confidentiality obligations sufficient to protect Customer Data at least as strictly as this DPA.  However, Supplier will remain solely responsible for and liable to Customer for the acts and omissions of all Authorized Personnel concerning the Processing of Customer Data as if such acts and omissions were Supplier’s own.  
2.7 Supplier will not (directly or indirectly) disclose Customer Data to any person other than Authorized Personnel without Customer’s prior written consent unless and to the extent (i) required by Legal Requirements, or (ii) with respect to Personal Data, as further provided in Sections 2.14 and 2.15 below, or (iii) under legal compulsion by a judicial or other governmental body of competent jurisdiction.
2.8  With reasonable notice under the circumstances, Supplier will allow Customer’s internal and external auditors and accountants, or any regulator with jurisdiction over the Customer Data or the designee of such regulator (collectively, “Auditors”), to examine the performance of Supplier’s obligations under this DPA, including those related to any Legal Requirements.  Supplier will provide reasonable assistance in such an examination.  Unless otherwise agreed, the examination described in this paragraph will occur during normal business hours, and (except as otherwise set forth below) each party will bear its own expenses relating to the examination.
2.9 At Customer’s request, Supplier will provide Customer with all information reasonably required to assist Customer in complying with its obligations under applicable Legal Requirements with respect to data protection impact assessments and prior consultation.  Further, Supplier will maintain a program designed to protect the privacy of individuals by embedding privacy into the design specifications of Supplier’s technologies, business practices and physical infrastructures, using industry standard practices designed to minimize the privacy risks to individuals.
2.10   Supplier will maintain technical and organizational measures sufficient to enable Customer to fulfill its obligations (as controller) with respect to the exercise of Data Subject rights, and at Customer’s request, will assist Customer in fulfilling requests from Data Subjects to exercise their rights in their Personal Data by: (a) making available to Customer the Personal Data necessary for Customer to respond to a Data Subject’s request for access to Personal Data about him or her; (b) assisting Customer in responding to a Data Subject’s request to correct Personal Data, or (if applicable) incorporating any amendments to the Personal Data; (c) assisting Customer in the restriction of processing where required; (d) assisting Customer in responding to a Data Subject’s lawful exercise of an erasure request or a request to port his or her Personal Data; and (e) providing the information necessary to enable Customer to provide an accounting of disclosures of Personal Data.
2.11   Supplier will only make an International Transfer of Personal Data originating in the European Union (“EU”), in the United Kingdom, in the Swiss Confederation, in the State of Israel, or in Brazil, if: (a) the country or territory to which the International Transfer is to be made is within the European Economic Area; or (b) the European Commission has determined that the country or territory to which the International Transfer is to be made provides an adequate level of protection for Processing of Personal Data; or (c) Supplier provides appropriate safeguards for the International Transfer in accordance with applicable Legal Requirements, such by having in place approved Binding Corporate Rules, or by adhering to either a certification mechanism or code of conduct which has been approved by the applicable regulator (for example, a Member State’s Supervisory Authority or the European Commission). If none of the foregoing apply to the transfer, then the transfer is subject to (i) the EU Standard Contractual Clauses, Decision (EU) 2021/914 of 4 June 2021 (the “SCCs”), and (ii) in the case of the United Kingdom, the SCCs as modified by the ICO International Data Transfer Addendum to the EU Commission Standard Contractual Clauses incorporated herein by reference (the “EU Clauses”).  To the extent there is any conflict with the terms of this DPA or the Agreement and the EU Clauses, the EU Clauses will control.
2.12   It is Supplier’s sole responsibility to ensure that any International Transfers of Personal Data made by Supplier or its Sub-Processors are always made in compliance with the Legal Requirements then currently valid and applicable in the jurisdiction from which such transfer originates.
2.13   The current list of Supplier’s Sub-Processors (“Approved Sub-Processor List”) for the Services is available at https://www.arnica.io/legal/subprocessors. Supplier will give Customer written notice of any proposed changes or additions to the Approved Sub-Processor List prior to authorizing any new Sub-Processor added after the execution of this DPA; if Customer has a reasonable basis to object to Supplier’s use of a new Sub-Processor, then Customer will notify Supplier in writing within 30 days after receipt of such notice.  If Customer objects to a new Sub-Processor, then Supplier will either: (a) recommend and provide an alternate Sub-Processor that is suitable to Customer; or (b) recommend and make available to Customer a change in the affected Services (including a change to Customer’s configuration, if applicable) to avoid processing of Personal Data by the objected-to Sub-Processor; or (c) recommend a modified use of the affected Services that avoids processing of Personal Data by the objected-to Sub-Processor.  Such recommendations will not unreasonably burden Customer or end users or diminish the Services.  If Supplier is unable to make any recommendations or changes within 60 days after its receipt of Customer’s notice objecting to the new Sub-Processor, then Customer may terminate the affected Services or the Agreement per Section 3 herein.
2.14   Where Customer approves a Sub‐Processor as described in this DPA:  (i) Supplier will restrict the Sub‐Processor’s Processing of Personal Data only to what is necessary for such Sub-Processor to perform its services to Supplier in relation to the Services, and for no other purpose; (ii) Supplier will enter into a written agreement with the Sub‐Processor that imposes the same obligations that Supplier has under this DPA; and (iii) Supplier will remain responsible for the Sub-Processor’s compliance with the obligations in this DPA and for any Sub-Processor acts or omissions that cause Supplier to breach any of its obligations under this DPA.
2.15   Supplier will notify Customer of Supplier’s discovery of a Security Incident within 72 hours by calling Supplier’s point of contact at Customer and concurrently sending written notice to Customer at a designated communication channel.  If Supplier’s failure to exercise reasonable diligence contributes to a delay in discovery of any Security Incident (by Supplier or any Authorized Personnel), then such delay constitutes a material breach of this DPA.  Supplier will reimburse Customer for all actual reasonable costs incurred by Customer in responding to and mitigating damages caused by any Security Incident.
2.16   To the extent known at the time of Supplier’s notice under Section 2.15 above, Supplier’s Security Incident notification to Customer must include all of the information described below (if and to the extent any of this information is not available at the time Supplier provides its notification to Customer, then Supplier will provide such information to Customer as soon as it becomes available, but in all cases within the timeframes required by Legal Requirements):  
a.   information about the types of Customer Data believed to be improperly disclosed, accessed, destroyed, lost, altered, or acquired.
b.   a brief description of what happened, including the date the Security Incident occurred, the date on which the Security Incident was discovered, and (if known) the root cause of the Security Incident.
c.   if the Security Incident involved Personal Data, the identification of each Data Subject whose Personal Data has been (or is reasonably believed to have been) accidentally or unlawfully destroyed, lost, altered, disclosed, or accessed without authorization during the time in question, the categories of Personal Data records involved, and the steps Data Subjects should take to protect themselves from potential harm.
d.   a brief description of what Supplier is doing to investigate the Security Incident, to mitigate losses, and to protect against any further Security Incidents ofsimilar origin.
e.   the name and contact information, including a telephone number and email address of the person(s) who will serve as the point(s) of contact for Customer (Supplier will ensure that such contact person(s) will be available to answer questions and provide additional information about the Security Incident).
f.    any other available information that must be provided to Data Subjects or regulators as required by Legal Requirements, and any other information reasonably requested by Customer.
2.17   Unless required by Legal Requirements, Supplier will not inform any third party of any Security Incident without obtaining Customer’s prior written consent (other than to inform a complainant that the matter has been forwarded to Customer).
2.18   Upon termination of the Services that require the Processing of Customer Data, or at any time at Customer’s request, at Customer’s option Supplier will (a) return or otherwise make available to Customer all Customer Data in Supplier’s possession or under Supplier’s control (including all copies or derivatives thereof, collectively, “Copies”) and/or (b) promptly and securely dispose of the Customer Data (including all Copies) in a manner that renders them completely unreadable and inaccessible and precludes their reconstruction or re-identification.  If Customer requires Supplier to return Customer Data, then Supplier will certify that it has retained no Copies thereof.  If Customer requires Supplier to destroy Customer Data and all Copies thereof, then Supplier will certify to Customer that the Customer Data and Copies have been destroyed in accordance with this paragraph.
2.19   With respect to any Personal Data that Supplier Processes that refers or relates to a  consumer governed by any state-level Legal Requirements governing personal information across industrial sectors as are now in effect, or as may in the future come into effect, including without limitation the California Consumer Protection Act of 2018, as amended by the California Privacy Rights Act of 2020, and the regulations associated therewith, the Colorado Privacy Act, the Connecticut Data Privacy Act, the Oregon Consumer Privacy Act, the Texas Data Privacy and Security Act, the Utah Consumer Privacy Act, and the Virginia Consumer Data Protection Act (collectively, the “State Comprehensive Data Protection Laws”), Supplier will not: (a) sell or share such Personal Data; (b) retain, use, or disclose such Personal Data for any purpose other than performing the Services; or (c) retain, use, or disclose such Personal Data outside of Supplier’s direct business relationship with you, and Supplier certifies that it understands and will comply with these restrictions. Supplier will comply with applicable obligations under the State Comprehensive Data Protection Laws and provide the same level of privacy protection as is required by the State Comprehensive Data Protection Laws. As is required by the State Comprehensive Data Protection Laws, Supplier grants Customer rights to take reasonable and appropriate steps to help ensure that it uses such Personal Data in a manner consistent with your obligations under the State Comprehensive Data Protection Laws.  Supplier will notify Customer in writing without undue delay if in its sole discretion that it determines it can no longer meet its obligations under the State Comprehensive Data Protection Laws.  Upon such notice, Supplier grants Customerthe right to take reasonable and appropriate steps to remediate unauthorized use of such Personal Data.  Supplier’s execution of this DPA constitutes Supplier’s certification that Supplier understands and will comply with the restrictions in this paragraph.

‍3.   Termination Due to Breach of DPA.  If Customer becomes aware that Supplier has breached a material term of this DPA, then Customer will give Supplier written notice of such breach in sufficient detail to enable Supplier to understand the specific nature of the breach. Customer will provide Supplier with the opportunity to cure the breach within a reasonable time. If the breach is not cured within a reasonable time by the Supplier as stated in this Section 3, termination by Customer will be without further obligation to Supplier, and Supplier will promptly refund to Customer pro-rated fees for Services not yet delivered or performed by the termination date if Customer paid for such Services in advance.  The rights and obligations of the parties which by their nature continue after the termination of this DPA or the Agreement (including Section 2.16 above) will survive and continue after termination of this DPA or Agreement (or both) for any reason, and will bind the parties and their successors and assigns.
‍
‍4.   Miscellaneous.
4.1 Indemnification.  Both parties will defend, indemnify and hold harmless Customer and its affiliates and their respective directors, officers, employees, contractors, distributors, resellers, customers, and end users for any actual or threatened claims, suits, costs (including attorneys’ fees), fines, penalties, losses, or damages caused by, related to, or arising out of other party’s acts or omissions, or the acts or omissions of other party’s affiliates or subcontractors or by anyone directly or indirectly employed by other party or by them, in connection with other party’s obligations under this DPA.
4.2 Construction.  Any provision which is required to be made part of this DPA or the Agreement by virtue of any Legal Requirement is incorporated herein by reference.  This DPA and the Agreement will be construed in a manner that facilitates both parties compliance with all Legal Requirements.
4.3 Equitable Relief.  Supplier acknowledges that any breach of its obligations set forth in this DPA may cause Customer irreparable harm for which monetary damages would not be adequate compensation and agrees that, in the event of such breach or threatened breach, Customer is entitled to equitable relief, including a restraining order, injunctive relief, specific performance, and any other relief that may be available from any court, in addition to any other remedy to which Customer may be entitled at law or in equity.
4.4 Amendment.  To the extent that any relevant provisions of any Legal Requirement is materially amended in a manner that changes the obligations of Customer, Supplier, Customer’s customers, or an end user, this DPA will be automatically amended to comply with the amended Legal Requirement.
4.5 GoverningLaw.  The governing law for this DPAis the governing law set forth in the particular Agreement to which the Personal Data Processed by Supplier pertains; however, if that particular Agreement either does not specify a country for governing law, then this DPA will be governed by the law of the state of Georgia. Each party has caused this DPA to be duly executed by its authorized representative.