In this Appendix:
“Appropriate Safeguards” means such legally enforceable mechanism(s) for transfers of Personal Data as may be permitted under Data Protection Laws from time to time;
“Data Protection Laws” means any law, enactment, regulation, regulatory policy, by law, ordinance or subordinate legislation relating to the processing, privacy, and use of Personal Data, as applicable to Ralliant, the Supplier and/or the Services, including without limitation:
1) in the UK: the Data Protection Act 2018, the “UK GDPR” (as defined by section 3(10) (as supplemented by section 205(4)) of the Data Protection Act 2018), the Privacy and Electronic Communications Regulations 2003 and the Council Directive 2002/58/EC (“ePrivacy Directive”)(collectively referred to as “UK Data Protection Laws”);
2) in the European Economic Area (“EEA”) countries: the General Data Protection Regulation ((EU) 2016/679) (“EU GDPR”) and the ePrivacy Directive;
3) in Switzerland: the Federal Act on Data Protection (“FADP”);
4) in Brazil: General Data Protection Law 13,709/2018 (“LGPD”); and
5) all applicable relevant laws or regulations and giving effect or corresponding to the above laws and any judicial or administrative interpretation of any of the above, and any guidance, guidelines, codes of practice, approved codes of conduct or approved certification mechanisms issued by any relevant Supervisory Authority;
6) The California Consumer Privacy Act and implementing regulations are not Data Protection Laws for the purpose of this Appendix;
“Data Processing Losses” means all liabilities and amounts, including all:
7) costs (including legal costs), claims, demands, actions, settlements, charges, procedures, expenses, losses and damages (including relating to material or non-material damage, which includes emotional distress);
8) loss or damage to reputation, brand or goodwill;
9) to the extent permitted by Applicable Law:
10) administrative fines, penalties, sanctions, liabilities or other remedies imposed by a Supervisory Authority;
11) compensation paid to a Data Subject;
12) the reasonable costs of compliance with investigations by a Supervisory Authority; and
13) the costs of loading Ralliant data and replacement of Ralliant materials and equipment, to the extent the same are lost, damaged or destroyed, and any loss or corruption of Ralliant data, including the costs of rectification or restoration of Ralliant data;
“Data Subject Request” means a request made by a Data Subject to exercise any rights of Data Subjects under Data Protection Laws;
“Complaint” means a complaint or request relating to either Party’s obligations under Data Protection Laws relevant to this Agreement, including any compensation claim from a Data Subject or any notice, investigation or other action from a Supervisory Authority;
“DPIA” means a data protection impact assessment or privacy impact assessment (as defined or used in the Data Protection Laws, including relevant guidance from Supervisory Authorities);
“Personal Data Breach” means any breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, any Protected Data;
“Protected Data” means Personal Data received from or made available or accessible by or on behalf of Ralliant, or otherwise obtained in connection with the performance of the Supplier’s obligations under this Agreement and subject to the Data Protection Laws, including as set out in Appendix A.5 – Data Processing Details;
“Security Measures” means Ralliant’s security policies and measures (including IT policies and measures) for the protection of Customer Data or Personal Data issued to Supplier by Ralliant from time to time, which as at the date hereof are as specified in Appendix A.6 – Security Measures.
“Sub-Processor” means another Data Processor engaged by the Supplier for carrying out processing activities in respect of the Protected Data on behalf of Ralliant, and authorised by Ralliant in accordance with clause 1.6;
“Supervisory Authority” means any local, national or multinational agency, department, official, parliament, public or statutory person or any government or professional body, regulatory or supervisory authority, board or other body responsible for administering Data Protection Laws;
"Supplier Personnel” means all employees, staff, other workers, agents and consultants of the Supplier who are engaged in the provision of the Services from time to time, except to the extent that these are a Data Processor that must be authorised by Ralliant in accordance with clause 1.6.

Interpretation
In this Appendix:
14) “Data Controller” (or “controller”), “Data Processor” (or “processor”), “Data Subject”, “international organisation”, “Personal Data” and “processing” and other defined terms shall have the meanings given to them in the Data Protection Laws (and related terms such as “process” have corresponding meanings) unless otherwise defined in this Agreement;
15) references to any Applicable Laws (including to the Data Protection Laws and to terms defined in such Applicable Laws shall be replaced with or incorporate (as the case may be) references to any Applicable Laws replacing, amending, extending, re-enacting or consolidating such Applicable Law and the equivalent terms defined in such Applicable Laws, once in force and applicable;
16) clause 1 (Data Protection) shall survive termination (for any reason) or expiry of this Agreement (or of any of the Services).

1. Data protection

1.1 Data Controller and Appointment of Data Processor
1.1.1 The Parties agree that, for the Protected Data, Ralliant shall be the Data Controller and the Supplier shall be the Data Processor, except that where Ralliant is a Data Processor, the Supplier is a sub-processor.

1.2 Compliance with Data Protection Laws and obligations
1.2.1 The Supplier shall comply with all Data Protection Laws in connection with the processing of Protected Data, the Services, and the exercise and performance of its respective rights and obligations under this Agreement.

1.2.2 The Supplier shall procure that any Sub-Processor that has access to Protected Data shall comply with the Supplier’s obligations under this clause 1.

1.2.3 Ralliant shall comply with all Data Protection Laws in respect of the performance of its obligations under this Agreement.

1.3 Details of processing and instructions
1.3.1 The processing to be carried out by the Supplier under this Agreement shall comprise the processing set out in Appendix A.5 – Data Processing Details, as updated from time to time by Ralliant.

1.3.2 Insofar as the Supplier processes Protected Data on behalf of Ralliant, the Supplier:
1) unless required to do otherwise by Applicable Law, shall (and shall ensure each person acting under its authority shall) process the Protected Data only on and in accordance with Ralliant’s documented instructions as set out in this clause 1 and Appendix A.5 – Data Processing Details, and as updated from time to time by the written agreement of the Parties (“Processing Instructions”);
2) if Applicable Law requires it to process Protected Data other than in accordance with the Processing Instructions, shall notify Ralliant of any such requirement before processing the Protected Data (unless Applicable Law prohibits such information on important grounds of public interest); and (3) shall immediately inform Ralliant in writing if, in the Supplier’s reasonable opinion, a Ralliant instruction infringes Data Protection Laws and explain the reasons for such opinion.

1.4 Technical and organisational measures
1.4.1 The Supplier shall implement and maintain, at its cost and expense, appropriate technical and organisational measures in relation to the processing of Protected Data by the Supplier:
1) such that the processing will meet the requirements of Data Protection Laws and ensure the protection of the rights of Data Subjects;
2) so as to ensure a level of security in respect of Protected Data processed by it appropriate to the risks that are presented by the processing, in particular from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Protected Data transmitted, stored or otherwise processed;
3) without prejudice to the foregoing, that are equivalent to or more protective of the Protected Data than the security measures set out in Appendix A.6 – Security Measures; and
4) without prejudice to clause 1.8, insofar as is possible, to assist Ralliant in the fulfilment of Ralliant’s obligations to respond to Data Subject Requests relating to Protected Data.

1.5 Security of processing
1.5.1 Without prejudice to clause 1.4.1(b), the Supplier shall, in respect of all Protected Data processed by it, comply with the requirements regarding security of processing set out in Data Protection Laws, this Agreement and any relevant Ralliant Policies notified to the Supplier in writing. The Supplier shall ensure that the Security Measures are the minimum security standards governing Supplier’s processing of the Protected Data.

1.6 Using other Sub-Processors
1.6.1 The Supplier shall not engage any third party to process the Protected Data without Ralliant’s prior written consent.

1.6.2 The Supplier shall, prior to any processing of Protected Data by the Sub-Processor, appoint the Sub-Processor under a binding written contract, with enforceable data protection obligations on the same terms, or terms more onerous than those, that apply to the Supplier under this clause 1 (“Processor Contract”), including in particular that the Sub-Processor:
1) provides sufficient guarantees to implement appropriate technical and organisational measures in such a manner that the processing will meet the requirements of Data Protection Laws; and
must obtain Ralliant’s prior written consent and comply with the conditions referred to in this clause 1.6 for engaging another Data Processor.

1.6.3 The Supplier shall:
1) promptly upon request by Ralliant provide the relevant details of any such Processor Contract to Ralliant;
2) where that Sub-Processor fails to fulfil its data protection obligations in accordance with the Processor Contract, remain fully liable to Ralliant for the performance of that Sub-Processor’s obligations; and
3) immediately cease using a Sub-Processor to process Protected Data upon receiving written notice from Ralliant requesting that the Sub-Processor ceases processing Protected Data for security reasons or concerns about the Sub-Processor’s ability to carry out the relevant processing in compliance with Data Protection Laws or this Agreement.

1.7 Personnel requirements
1.7.1 The Supplier shall:
1) ensure that Supplier Personnel (and shall procure that Sub-Processor personnel) processing Protected Data have entered into a binding contractual obligation with the Supplier to keep the Protected Data confidential (except where disclosure is required by Applicable Law, in which case the Supplier shall, where practicable and not prohibited by such Applicable Law, notify Ralliant of any such requirement before such disclosure); and (2) ensure the reliability of the Supplier Personnel processing Protected Data and further ensure that the Supplier Personnel processing Protected Data receive adequate training on compliance with this clause
1 and the Data Protection Laws applicable to the processing.

1.8 Data Subject rights
1.8.1 The Supplier shall:
1) at no cost to Ralliant, record and then refer all Data Subject Requests which the Supplier receives to Ralliant within three days of receipt of the Data Subject Requests;
2) at its cost and expense, provide such information and cooperation and other assistance as Ralliant requests in relation to a Data Subject Request within the timescales reasonably required by Ralliant; and
3) not respond to any Data Subject Request without Ralliant’s prior written authorisation.

1.9 Assistance with Ralliant’s compliance
1.9.1 The Supplier shall, at its own cost and expense, provide such information, cooperation and other assistance as Ralliant requests to ensure Ralliant’s compliance with its obligations under Data Protection Laws, including with respect to:
1) security of processing;
2) any remedial action and notifications to be taken in response to any Personal Data Breach or Complaint, including (subject in each case to Ralliant’s prior written authorisation) regarding any notification of the Personal Data Breach to Supervisory Authorities and/or communication to affected Data Subjects, including in accordance with clause 1.13;
3) DPIAs, by promptly providing such information and cooperation as Ralliant may reasonably require for the purpose of assisting Ralliant in carrying out a DPIA, and periodic reviews to assess if the processing of Protected Data is performed in compliance with the outcomes of the DPIA;
4) prior consultation with a Supervisory Authority regarding high risk processing, by promptly and in consultation with Ralliant:
(a) providing such information and cooperation as Ralliant or a Supervisory Authority requests for the purpose of assisting in any consultation by Ralliant with the Supervisory Authority; and
(b) complying with any advice by a Supervisory Authority concerning the Supplier’s processing activities related to this Agreement.

1.10 International data transfers
1.10.1 This clause 1.10 applies to Protected Data subject to EU GDPR, UK GDPR, FADP, or LGPD.

1.10.2 The Supplier shall not (and shall procure that any Sub Processor or subcontractor shall not) transfer, or allow the onward transfer of, any Protected Data to any country or recipient outside the United Kingdom, EEA or Switzerland (in the case of Protected Data subject to EU GDPR, UK GDPR or FADP) or outside Brazil (in the case of Protected Data subject to LGPD) or to any international organisation (individually and collectively, an “International Recipient”) without Ralliant’s prior written consent.

1.10.3 If Ralliant consents to the transfer of Protected Data to an International Recipient, the Supplier shall ensure that such transfer (and any subsequent onward transfer):
1) is pursuant to a written contract including equivalent or more onerous obligations on the Sub-Processor in respect of the Protected Data (in particular relating to security and confidentiality) as apply to the Supplier under this clause 1;
2) is effected by way of Appropriate Safeguards, the form of which being subject to Ralliant’s prior written approval (which shall not be unreasonably withheld or delayed);
3) complies with clause 1.2.1 and any requirements specified in Appendix A.5 – Data Processing Details including the Security Measures; and
4) otherwise complies with Data Protection Laws.

1.10.4 Ralliant consents to the transfer of Protected Data to International Recipients by way of (i) an applicable adequacy decision under the Data Protection Laws or (ii) Appendix A.2 – European Economic Area, United Kingdom, and Switzerland Standard Contractual Clauses or Appendix A.3 – Brazil Standard Contractual Clauses as applicable.

1.11 Records
1.11.1 The Supplier shall maintain complete, accurate and up to date written records of all categories of processing activities carried out on behalf of Ralliant, containing such information as Ralliant may reasonably require, including:
1) the name and contact details of the Data Processor(s) and of each Data Controller on behalf of which the Data Processor is acting, and of the Supplier’s representative and data protection officer (if any);
2) the categories of processing carried out on behalf of each Data Controller;
3) where applicable, details of transfers of Protected Data to an International Recipient, including the identification of that International Recipient and the relevant countries to which such data is transferred, and details of the Appropriate Safeguards used; and
4) a general description of the technical and organisational security measures referred to in clause 1.4.1(b).

1.12 Compliance, information and audit
1.12.1 The Supplier shall (and shall procure that its Sub-Processors) make available to Ralliant on request in a timely manner (and in any event within three days):
1) copies of the records under clause 1.11; and
2) such other information as Ralliant reasonably requires to demonstrate the Supplier’s compliance with its obligations under Data Protection Laws and this Agreement, including sufficiently detailed information about the technical and organisational measures that are implemented and maintained by the Supplier.

1.12.2 The Supplier shall (and shall procure that its Sub-Processors shall) allow for and contribute to audits, including inspections, conducted by Ralliant or another auditor mandated by Ralliant for the purpose of demonstrating compliance by the Supplier with its obligations under Data Protection Laws and under this clause 1, including allowing reasonable access for Ralliant or such other auditor to:
1) the facilities, equipment, premises and sites on which Protected Data and/or the records referred to in clause 1.11 are held, and to any other equipment or facilities used in the provision of the Services (in each case whether or not owned or controlled by the Supplier); and
2) the Supplier Personnel

provided that Ralliant shall, where practicable, give the Supplier reasonable prior notice of such audit and/or inspection and conduct the same during normal business hours.

1.12.3 If any audit or inspection reveals a material noncompliance by the Supplier with its obligations under Data Protection Laws or a breach by the Supplier of its data protection obligations under this Agreement, the Supplier shall promptly on request:
1) pay the reasonable costs of Ralliant or its mandated auditors for the audit or inspection; and
2) resolve (and shall procure that its Sub-Processors likewise resolve), at its own cost and expense, all instances of data protection or security noncompliance discovered by Ralliant and reported to the Supplier that reveal a breach or potential breach by the Supplier (or a Sub-Processor) of its obligations under this clause 1.

1.12.4 Ralliant may share any notification, details, records or information provided by or on behalf of the Supplier under this clause 1.12 or clause 1.13 with its respective affiliates, professional advisors, and any Supervisory Authority.

1.12.5 If the Supplier (or a Sub-Processor) is in breach of its obligations under this clause 1, Ralliant may suspend the transfer of Protected Data to the Supplier until the breach is remedied.

1.13 Notification of Personal Data Breaches and Complaints
1.13.1 In respect of any actual or suspected Personal Data Breach involving the Supplier or a Sub-Processor, the Supplier shall:

1) notify Ralliant of the Personal Data Breach in accordance with the process set out under the heading “4. Incident Response Management” in Appendix A.6 – Security Measures; and

2) provide Ralliant without undue delay, wherever possible no later than forty-eight (48) hours after becoming aware of such Personal Data Breach, with such details as Ralliant requires regarding:

(a) the nature of such Personal Data Breach, including the categories and approximate numbers of Data Subjects and Personal Data records concerned;
(b) any investigations into such Personal Data Breach;
(c) the likely consequences of such Personal Data Breach; and
(d) any measures taken, or that the Supplier recommends to take, to address such Personal Data Breach, including to mitigate its possible adverse effects and prevent the re-occurrence of such Personal Data Breach or a similar breach,

provided that, without prejudice to the above obligations, if the Supplier cannot provide all these details within the aforesaid timeframe, it shall in any event before the end of said timeframe provide Ralliant with its reasons for the delay and an expectation for when it reasonably expects to be able to provide Ralliant with such details.

1.13.2 The Supplier shall promptly and in any event within two days inform Ralliant if it receives a Complaint and provide Ralliant with full details of such Complaint.

1.14 Deletion or return of Protected Data and copies
1.14.1 The Supplier shall without delay:

1) at Ralliant’s written request, either securely delete or securely return all the Protected Data to Ralliant in such form as Ralliant reasonably requests, after the earlier of:
(i) the end of the provision of the relevant Services related to processing; or
(ii) once processing by the Supplier of any Protected Data is no longer required for the purpose of the Supplier’s performance of its relevant obligations under this Agreement; and

2) securely delete all other existing copies of the Protected Data, except only for those copies that are required to be stored by Applicable Law and, in which case, the Supplier shall inform Ralliant of any such requirement; and

3) upon full performance of its obligations under this clause 1.14, provide Ralliant with a written declaration of such performance.

1.15 Liability and indemnities
1.15.1 The Supplier shall indemnify and keep indemnified Ralliant in respect of all Data Processing Losses suffered or incurred by, awarded against or agreed to be paid by, Ralliant or any affiliate thereof, arising from or in connection with:
1) any breach by the Supplier of its obligations under this clause 1 or of Data Protection Laws; or
2) the Supplier (or any person acting on its behalf) acting outside or contrary to the lawful Processing Instructions of Ralliant in respect of the processing of Protected Data.

1.15.2 This clause 1.15 is intended to apply to the allocation of liability for Data Protection Losses as between the Parties, including with respect to compensation to Data Subjects, notwithstanding any provisions under Data Protection Laws to the contrary, except:
1) to the extent not permitted by Applicable Law (including Data Protection Laws); and
2) that it does not affect the liability of either Party to any Data Subject.

In addition to the definitions set out in Appendix A.1 – General Data Processing Terms, the “Standard Contractual Clauses” means the following:

(a) EU GDPR and FADP: the standard contractual clauses pursuant to Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council (“EU SCCs”), available here: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj and adopted by the Federal Data Protection and Information Commissioner of Switzerland; and
(b) UK GDPR: the international data transfer addendum to the EU SCCs adopted by the UK Information Commissioner’s Office, available here: https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/international-data-transfer-agreement-and-guidance/ (“UK SCCs”);

and any similar such clauses adopted by a Supervisory Authority, including without limitation any successor clauses thereto.

If (a) Supplier is a Processor Processing Protected Data subject to the GDPR, UK GDPR or FADP outside the EEA, Switzerland and the UK pursuant to this Agreement and (b) Ralliant is a Controller or Processor of such Protected Data, Module Two (Controller to Processor) or Module Three (Processor to Processor), as may be applicable, of the EU SCCs shall apply. The Parties agree that the relevant Module(s) of the EU SCCs and the UK SCCs are incorporated herein without further need for reference, incorporation, or attachment and that by executing this Agreement, each Party is deemed to have executed the Standard Contractual Clauses.

The Parties agree that the Standard Contractual Clauses shall not be amended, modified, or otherwise altered by any other provision of this Agreement, except as set out for the FADP and UK GDPR in sections 3 and 4 below. In the event of any conflict between the terms of this Agreement and the Standard Contractual Clauses, the terms of the Standard Contractual Clauses shall prevail.

The information required for the purposes of completing Annexes I to III the Standard Contractual Clauses is provided in this Appendix and Appendix A.5 – Data Processing Details. 

If (a) Supplier is a Processor Processing Protected Data subject to the LGPD outside Brazil pursuant to this Agreement and (b) Ralliant is a Controller or Processor of such Protected Data, the Brazil SCCs shall apply.

The Parties agree that the Brazilian SCCs are incorporated herein without further need for reference, incorporation, or attachment and that by executing this Agreement, each Party is deemed to have executed the Brazilian SCCs. The Parties agree that the Brazilian SCCs shall not be amended, modified, or otherwise altered by any other provision of this Agreement. In the event of any conflict between the terms of this Agreement and the Brazilian SCCs, the terms of the Brazilian SCCs shall prevail.

The information required for the purposes of the Brazilian SCCs is provided in this Appendix and Appendix A.5 – Data Processing Details.

To the extent that Ralliant is a Controller of the Protected Data, Option A applies. Ralliant is responsible for each of the obligations set out in Option A.

If Ralliant and Supplier are both Processors of the Protected Data, Option B applies. Ralliant shall keep a record of the third-party controller information required by Option B and make this available to the Supplier on request.

In this Appendix:
“CCPA” means the California Consumer Privacy Act and implementing regulations.
“Data Incident” means a known or reasonably suspected unauthorized or unlawful access to, disclosure, modification, destruction, deletion, loss of, or disruption or loss of access to Ralliant Personal Information.
“Process,” “Processed” or “Processing” means any operation or set of operations that are performed on Personal Information or on sets of Personal Information, including by automated means, and pursuant to the instructions set forth herein.

Capitalized terms that are not defined herein shall have the same meaning as in the CCPA.

a) General Obligations. Supplier will Process Personal Information collected pursuant to the Agreement (“Ralliant Personal Information”) in compliance with applicable laws, including the CCPA, and in compliance with this Appendix. Among other things, in relation to Ralliant Personal Information, Ralliant shall provide the same level of privacy protection as the CCPA requires of Ralliant/OpCo with respect to such information.

b) Scope of the Processing. Supplier will Process Ralliant Personal Information for the purpose(s) set forth in Appendix A.5 – Data Processing Details and shall not Process Ralliant Personal Information for any other purposes, unless permitted by the CCPA.

c) Prohibited Uses. Supplier is prohibited from and represents and certifies its understanding that it is prohibited from:
i. Selling, Sharing, or otherwise disclosing Ralliant Personal Information
ii. Retaining, using, or disclosing Ralliant Personal Information for any purpose, including any commercial purpose, other than the purpose(s) set forth in Appendix A.5 – Data Processing Details, to engage a subcontractor in compliance with this Appendix, or as otherwise expressly permitted by the CCPA;
iii. Retaining, using, or disclosing Ralliant Personal Information outside of the direct relationship between Ralliant and Supplier, including combining or updating Ralliant Personal Information with Personal Information collected from another source, including Supplier’s own direct interaction with a Consumer, unless expressly permitted by the CCPA.

a) Cooperation. Supplier shall comply with Ralliant’s written instructions to delete Personal Information and instruct any subcontractors engaged in Processing Ralliant Personal Information to do the same. Supplier shall make available to Ralliant all information necessary to comply with and demonstrate Supplier’s compliance with the CCPA.

b) Data Subject Requests.
i. Supplier shall cooperate with and provide all reasonable support to cause Ralliant to comply with Ralliant’s obligations to data subjects under the CCPA, including responding to data subject requests. Upon written request from Ralliant, Supplier shall provide necessary information to Ralliant to fulfill its obligations under the CCPA.
ii. In the event that any data subject request concerning Ralliant Personal Information is made directly to Supplier, Supplier shall forward the request to Ralliant within five (5) calendar days after Supplier’s receipt of the request. Supplier shall not provide a response to the requestor without Ralliant’s prior authorization.
iii. In the event that any request from applicable legal or regulatory authorities is made directly to Supplier, Supplier shall, unless legally prohibited, forward the request to Ralliant without undue delay, no later than five (5) calendar days within Supplier’s receipt of the request and shall not respond to such communication directly without Ralliant’s prior authorization, other than to inform the requestor that Supplier is not authorized to directly respond to a request. If Supplier is legally required to directly respond to such a request, Supplier will notify Ralliant without undue delay and provide it with a copy of the request unless legally prohibited from doing so.

c) Data Processing Assessments. Supplier shall provide information to Ralliant necessary to enable Ralliant to conduct and document any data processing assessments to the extent required under the CCPA.

Supplier certifies that it understands and will comply with the restrictions on its Processing of Personal Information as set forth in the CCPA and in this Appendix.

If Supplier becomes aware or makes a determination that it can no longer meet its obligations under the CCPA or this Appendix, it shall notify Ralliant without undue delay.

1. Subject-matter of processing:
Supplier processes Personal Data / Personal Information in connection with the provision of the Services (as further described in this Agreement and any SOW).

2. Duration of processing:
Supplier processes Personal Data / Personal Information for the term of this Agreement and provision of the Services.

3. Nature and purpose of the processing:
Supplier processes Personal Data / Personal Information as required to provide the Services (as further described in this Agreement and any SOW).

4. Type of personal data:
Supplier processes the categories of Personal Data / Personal Information as required to provide the Services (as further described in this Agreement and any SOW).

5. Categories of data subjects:
The categories of data subjects whose Personal Data / Personal Information are processed by Supplier are as required to provide the Services (as further described in this Agreement and any SOW).

6. Sensitive personal data and description of applied restrictions or safeguards:
Supplier processes the categories of sensitive Personal Data / Personal Information required to provide the Services (as further described in this Agreement and any SOW). The restrictions and safeguards applied to the processing of Personal Data / Personal Information are further described in Appendix A.6 – Security Measures.

7. Roles of the Parties:
Ralliant acts as a controller or data processor, as applicable. Supplier acts as a processor. In relation to international transfers, Ralliant acts as data exporter and Supplier acts as data importer.

8. Approved sub-processors:
The following processors are approved pursuant to clause 1.6 of Appendix A.1 – General Data Processing Terms:

9. Additional instructions:
See Addendum C – Security Measures, which shall form a part of this Appendix.

10. Description of international transfers (where applicable):
The data exporter transfers Personal Data /Personal Information to the data importer to perform some or all of the processing described above in a third country.
a) Frequency of the transfer. The transfer will occur continuously during the provision of the Services.
b) Method of transfer. The transfer will occur as required for the Services (as further described in this Agreement and any SOW).
c) Retention period. The Personal Data will be retained for as long as necessary for the provision of the Services.
d) Combination with personal data collected by the data exporter. The Personal Data received from the data exporter may be combined with Personal Data collected by the data importer as required for the provision of the Services (as further described in this Agreement and any SOW).
e) Transfers to sub-processors. The data importer transfers the Personal Data to the sub-processors located in third countries listed above to perform some or all of the processing described above.