The purpose of these standard contractual clauses (the "Clauses") is to ensure compliance with Article 28(3) and (4) of the GDPR for the Processing of Personal Data by the Processor on behalf of the Controller.

The Parties have agreed to these Clauses in order to ensure compliance with Article 28(3) and (4) of the GDPR.

These Clauses apply to the Processing of Personal Data as specified in Annex II to this DPA.

Annexes I to IV to this DPA are an integral part of these Clauses.

These Clauses are without prejudice to obligations to which the Controller is subject by virtue of the GDPR.

These Clauses do not by themselves ensure compliance with obligations related to international transfers in accordance with Chapter V of the GDPR.

The Parties undertake not to modify the Clauses, except for adding information to the Annexes or updating information in them.

This does not prevent the Parties from including the standard contractual clauses laid down in these Clauses in a broader contract, or from adding other clauses or additional safeguards provided that they do not directly or indirectly contradict the Clauses or detract from the fundamental rights or freedoms of data subjects.

Where these Clauses use the terms defined in the GDPR, those terms shall have the same meaning as in that Regulation.

These Clauses shall be read and interpreted in the light of the provisions of the GDPR.

These Clauses shall not be interpreted in a way that runs counter to the rights and obligations provided for in the GDPR or in a way that prejudices the fundamental rights or freedoms of the data subjects.

Any entity that is not a Party to these Clauses may, with the agreement of all the Parties, accede to these Clauses at any time as a controller or a processor by completing the Annexes and signing Annex I.

Once the Annexes referred to in paragraph (a) are completed and signed, the acceding entity shall be treated as a Party to these Clauses and have the rights and obligations of a controller or a processor, in accordance with its designation in Annex I.

The acceding entity shall have no rights or obligations resulting from these Clauses from the period prior to becoming a Party.

The Processor shall Process Personal Data only on documented instructions from the Controller, unless required to do so by Union or Member State law to which the Processor is subject. In this case, the Processor shall inform the Controller of that legal requirement before Processing, unless the law prohibits this on important grounds of public interest. Subsequent instructions may also be given by the Controller throughout the duration of the Processing of Personal Data. These instructions shall always be documented.

The Processor shall immediately inform the Controller if, in the Processor’s opinion, instructions given by the Controller infringe the GDPR or the applicable Union or Member State data protection provisions.

The Processor shall at least implement the technical and organisational measures specified in Annex III to this DPA to ensure the security of the Personal Data. This includes protecting the data against a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access to the data (personal data breach). In assessing the appropriate level of security, the Parties shall take due account of the state of the art, the costs of implementation, the nature, scope, context and purposes of Processing and the risks involved for the data subjects.

The Processor shall grant access to the Personal Data undergoing Processing to members of its personnel only to the extent strictly necessary for implementing, managing and monitoring of the contract. The Processor shall ensure that persons authorised to Process the Personal Data received have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

The Parties shall be able to demonstrate compliance with these Clauses.

The Processor shall deal promptly and adequately with inquiries from the Controller about the Processing of data in accordance with these Clauses.

The Processor shall make available to the Controller all information necessary to demonstrate compliance with the obligations that are set out in these Clauses and stem directly from the GDPR. At the Controller’s request, the Processor shall also permit and contribute to audits of the Processing activities covered by these Clauses, at reasonable intervals or if there are indications of non-compliance. In deciding on a review or an audit, the Controller may take into account relevant certifications held by the Processor.

The Controller may choose to conduct the audit by itself or mandate an independent auditor. Audits may also include inspections at the premises or physical facilities of the Processor and shall, where appropriate, be carried out with reasonable notice.

The Parties shall make the information referred to in this Clause, including the results of any audits, available to the competent supervisory authority/ies on request.

GENERAL WRITTEN AUTHORISATION: The Processor has the Controller’s general authorisation for the engagement of sub-processors from an agreed list. The Processor shall specifically inform in writing the Controller of any intended changes of that list through the addition or replacement of sub-processors at least thirty (30) calendar days in advance, thereby giving the Controller sufficient time to be able to object to such changes prior to the engagement of the concerned sub-processor(s). The Processor shall provide the Controller with the information necessary to enable the Controller to exercise the right to object. Notwithstanding the foregoing, where the Processor needs to add or replace a sub-processor on shorter notice due to (i) the sub-processor’s insolvency, (ii) a material security incident affecting the sub-processor, (iii) the sub-processor’s material breach of its data protection obligations, or (iv) any other circumstance requiring immediate action to protect the security or integrity of the Services or the Personal Data, the Processor may make such addition or replacement on as much advance notice as is reasonably practicable (and in any event with not less than five (5) working days' notice where reasonably possible), with prompt notice to the Controller of the circumstances justifying the shortened notice period.

Where the Processor engages a sub-processor for carrying out specific Processing activities (on behalf of the Controller), it shall do so by way of a contract which imposes on the sub-processor, in substance, the same data protection obligations as the ones imposed on the Processor in accordance with these Clauses. The Processor shall ensure that the sub-processor complies with the obligations to which the Processor is subject pursuant to these Clauses and to the GDPR.

At the Controller’s request, the Processor shall provide a copy of such a sub-processor agreement and any subsequent amendments to the Controller. To the extent necessary to protect business secret or other confidential information, including Personal Data, the Processor may redact the text of the agreement prior to sharing the copy.

The Processor shall remain fully responsible to the Controller for the performance of the sub-processor’s obligations in accordance with its contract with the Processor. The Processor shall notify the Controller of any failure by the sub-processor to fulfil its contractual obligations.

The Processor shall agree a third party beneficiary clause with the sub-processor whereby — in the event the Processor has factually disappeared, ceased to exist in law or has become insolvent — the Controller shall have the right to terminate the sub-processor contract and to instruct the sub-processor to erase or return the Personal Data.

Any transfer of data to a third country or an international organisation by the Processor shall be done only on the basis of documented instructions from the Controller or in order to fulfil a specific requirement under Union or Member State law to which the Processor is subject and shall take place in compliance with Chapter V of the GDPR.

The Controller agrees that where the Processor engages a sub-processor in accordance with Clause 7.7 for carrying out specific Processing activities (on behalf of the Controller) and those Processing activities involve a transfer of Personal Data within the meaning of Chapter V of the GDPR, the Processor and the sub-processor can ensure compliance with Chapter V of the GDPR by using standard contractual clauses adopted by the Commission in accordance with Article 46(2) of the GDPR, provided the conditions for the use of those standard contractual clauses are met.

The Processor shall promptly notify the Controller of any request it has received from the data subject. It shall not respond to the request itself, unless authorised to do so by the Controller.

The Processor shall assist the Controller in fulfilling its obligations to respond to data subjects' requests to exercise their rights, taking into account the nature of the Processing. In fulfilling its obligations in accordance with paragraphs (a) and (b), the Processor shall comply with the Controller’s instructions.

In addition to the Processor’s obligation to assist the Controller pursuant to Clause 8(b), the Processor shall furthermore assist the Controller in ensuring compliance with the following obligations, taking into account the nature of the data Processing and the information available to the Processor: (i) the obligation to carry out a data protection impact assessment where a type of Processing is likely to result in a high risk to the rights and freedoms of natural persons; (ii) the obligation to consult the competent supervisory authority/ies prior to Processing where a data protection impact assessment indicates that the Processing would result in a high risk in the absence of measures taken by the Controller to mitigate the risk; (iii) the obligation to ensure that Personal Data is accurate and up to date, by informing the Controller without delay if the Processor becomes aware that the Personal Data it is Processing is inaccurate or has become outdated; (iv) the obligations in Article 32 of the GDPR.

The Parties shall set out in Annex III to this DPA the appropriate technical and organisational measures by which the Processor is required to assist the Controller in the application of this Clause as well as the scope and the extent of the assistance required.

in notifying the personal data breach to the competent supervisory authority/ies, without undue delay after the Controller has become aware of it, where relevant (unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons);

in obtaining the following information which, pursuant to Article 33(3) of the GDPR, shall be stated in the Controller’s notification, and must at least include: (1) the nature of the Personal Data including where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of Personal Data records concerned; (2) the likely consequences of the personal data breach; (3) the measures taken or proposed to be taken by the Controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects;

in complying, pursuant to Article 34 of the GDPR, with the obligation to communicate without undue delay the personal data breach to the data subject, when the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons.

a description of the nature of the breach (including, where possible, the categories and approximate number of data subjects and data records concerned);

the details of a contact point where more information concerning the personal data breach can be obtained;

its likely consequences and the measures taken or proposed to be taken to address the breach, including to mitigate its possible adverse effects.

Without prejudice to any provisions of the GDPR, in the event that the Processor is in breach of its obligations under these Clauses, the Controller may instruct the Processor to suspend the Processing of Personal Data until the latter complies with these Clauses or the contract is terminated. The Processor shall promptly inform the Controller in case it is unable to comply with these Clauses, for whatever reason.

The Controller shall be entitled to terminate the contract insofar as it concerns Processing of Personal Data in accordance with these Clauses if: (1) the Processing of Personal Data by the Processor has been suspended by the Controller pursuant to point (a) and if compliance with these Clauses is not restored within a reasonable time and in any event within one month following suspension; (2) the Processor is in substantial or persistent breach of these Clauses or its obligations under the GDPR; (3) the Processor fails to comply with a binding decision of a competent court or the competent supervisory authority/ies regarding its obligations pursuant to these Clauses or to the GDPR.

The Processor shall be entitled to terminate the contract insofar as it concerns Processing of Personal Data under these Clauses where, after having informed the Controller that its instructions infringe applicable legal requirements in accordance with Clause 7.1(b), the Controller insists on compliance with the instructions.

Following termination of the contract, the Processor shall, at the choice of the Controller, delete all Personal Data Processed on behalf of the Controller and certify to the Controller that it has done so, or return all the Personal Data to the Controller and delete existing copies unless Union or Member State law requires storage of the Personal Data. Until the data is deleted or returned, the Processor shall continue to ensure compliance with these Clauses. For the avoidance of doubt, this Clause 10(d) does not apply to Resultant Data, which is governed by the Section of the SSA titled "Provider Materials and Resultant Data".

Without modifying the Clauses themselves (consistent with Clause 2 of this DPA), the Processor may update the Annexes to this DPA from time to time to reflect changes in the Services, sub-processors, technical and organisational measures, or business processes, or for legal, regulatory, or security reasons. The Processor shall provide the Controller with ten (10) days' advance written notice of any such update before it becomes effective. If the Controller does not agree to the updated Annex, the Controller may terminate the SSA with respect to the affected Processing on one (1) day’s written notice given within that ten (10)-day period. If the Controller does not give such notice within the ten (10)-day period, the updated Annex is deemed accepted and becomes effective at the end of the period. This Clause 10(e) does not displace the sub-processor change-notice procedure set forth in Clause 7.7 of this DPA, which continues to apply to additions or replacements of sub-processors.

The Parties incorporate by reference into this DPA the Standard Contractual Clauses adopted by the European Commission pursuant to Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council (the "SCCs"). The SCCs as incorporated into this DPA shall be deemed executed between the Parties as of the Effective Date of the SSA. The authoritative text of the SCCs is available at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj.

The Parties acknowledge that the SCCs constitute appropriate safeguards within the meaning of Article 46(2)(c) of the GDPR for the transfer of Personal Data to a third country.

If there is any discrepancy between any copy of the SCCs and the authoritative text published by the European Commission, the authoritative text shall prevail.

Provider shall not modify the SCCs. The Parties may add information to the Appendix tables set forth in this DPA, and may add other clauses or additional safeguards in this DPA or in the SSA, provided that they do not contradict, directly or indirectly, the SCCs or prejudice the fundamental rights or freedoms of data subjects.

Module: Module Two (Controller to Processor) applies where Customer Processes Personal Data as a controller; Customer acts as the controller and data exporter, and Provider as the processor and data importer. Where Customer Processes Personal Data as a processor on behalf of its own customers, Module Three (Processor to Processor) applies to those transfers; Customer acts as data exporter and Provider as data importer, and the Annexes apply with the roles read accordingly.

SCC Clause 7 (Docking Clause): the optional Docking Clause does NOT apply. Additional parties may not accede to the SCCs without the written consent of both Parties.

SCC Clause 9 (Use of sub-processors): the Parties select Option 2 — General Written Authorisation. Provider shall give notice of any intended changes to the Sub-processor List at least thirty (30) calendar days in advance, or the shorter notice permitted by Clause 7.7(a) in the circumstances stated there.

SCC Clause 11 (Redress): the optional independent dispute resolution language does NOT apply. The standard redress mechanisms set forth in SCC Clause 11 apply without modification.

SCC Clause 17 (Governing law): the Parties select the law of the Kingdom of the Netherlands as the governing law of the SCCs.

SCC Clause 18(b) (Choice of forum and jurisdiction): the Parties select the competent courts of Amsterdam, the Netherlands, as the courts having jurisdiction over disputes arising from the SCCs, without prejudice to the data subject’s right to bring proceedings in the Member State of his or her habitual residence.

Annexes: Annex I of the SCCs (List of Parties; Description of the Transfer; Competent Supervisory Authority) is completed by Annex I and Annex II to this DPA; Annex II of the SCCs (Technical and Organisational Measures) by Annex III to this DPA; Annex III of the SCCs (List of Sub-processors) by Annex IV to this DPA.

If the European Commission adopts a successor decision that materially amends, replaces, or repeals the SCCs, or if a competent supervisory authority issues binding guidance that materially affects the operation of the SCCs as incorporated in this DPA, the Parties shall negotiate in good faith any amendments to this DPA required to implement such successor decision or guidance.

If the Parties do not reach mutual agreement on the required amendments within sixty (60) days from the date the successor decision or guidance enters into force, either Party may terminate the SSA in respect of the Processing of Personal Data under this DPA upon thirty (30) days' written notice to the other Party. Customer shall pay all Fees accrued through the effective date of such termination, and Provider shall refund any Fees prepaid for periods after that date on a pro rata basis.

Where the successor decision provides clauses that replace the SCCs for the transfers covered by this DPA, those clauses replace the SCCs as incorporated by Clause 12 from the date on which they must be used, and Provider publishes the corresponding update to this DPA under Clause 21(c); paragraphs (a) and (b) then do not apply.

Where the Processing of Personal Data of data subjects in the United Kingdom by Provider or by a Sub-processor involves a transfer of Personal Data from the United Kingdom to a third country that does not benefit from adequacy regulations under Article 45 of the UK GDPR, the Parties incorporate by reference the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the Information Commissioner’s Office (Version B1.0, in force 21 March 2022, the "UK Addendum"), the authoritative text of which is available at https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/international-data-transfer-agreement-and-guidance/. The UK Addendum operates as an addendum to the SCCs incorporated by Clause 12, which are deemed to apply, with the modifications set forth in the UK Addendum, to such transfers. The tables of the UK Addendum are completed in Annex V to this DPA.

For the purposes of such Processing, references in Part A to the GDPR are read as references to the UK GDPR and the Data Protection Act 2018, references to a Member State or the European Economic Area as references to the United Kingdom, and references to the competent supervisory authority as references to the Information Commissioner’s Office (or its successor).

If the Information Commissioner’s Office (or its successor) issues a successor to the UK Addendum that materially affects its operation, Clause 14 applies mutatis mutandis.

This Part C applies to the extent the Processing of Personal Data under the SSA is subject to the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act (the "CCPA"), or to another state privacy law of the United States of general application that distinguishes the roles of "business" or "controller" and "service provider", "contractor" or "processor" (together, "US State Privacy Laws"). Terms used in this Part C have the meanings given in the applicable US State Privacy Law.

Customer is the "business" (or "controller") and Provider is the "service provider" (or "processor") with respect to Personal Data Processed on Customer’s behalf, as set out in the Section of the US SSA titled "Privacy and Data Protection Roles" and, for Customers contracting with Maestra B.V., in this DPA as a whole.

Provider Processes Personal Data on Customer’s behalf for the business purpose of providing the Services under the SSA, as described in the SSA, Exhibit C (including its Annex 1) and the Documentation, and for no other purpose.

Provider shall not: (i) sell or share Personal Data; (ii) retain, use or disclose Personal Data for any purpose, including any commercial purpose, other than the business purpose specified in paragraph (a), or outside the direct business relationship between Provider and Customer, except as permitted by the applicable US State Privacy Law; (iii) combine Personal Data received from or on behalf of Customer with personal information received from or on behalf of another person, or collected from Provider’s own interaction with a consumer, except as permitted by the applicable US State Privacy Law for service providers or processors. Provider’s rights with respect to Resultant Data and Anonymized Data under the Section of the SSA titled "Provider Materials and Resultant Data" are not affected.

Provider shall comply with the obligations applicable to service providers and processors under the applicable US State Privacy Laws and shall provide the level of privacy protection they require.

Provider shall notify Customer if Provider determines that it can no longer meet its obligations under the applicable US State Privacy Laws.

Customer may take reasonable and appropriate steps to ensure that Provider uses Personal Data in a manner consistent with Customer’s obligations under the applicable US State Privacy Laws, in accordance with Clause 22, and, upon notice, to stop and remediate unauthorised use of Personal Data.

Provider engages Sub-processors under written contracts that bind them to the obligations of this Part C to the extent applicable to the services they provide, and notifies Customer of Sub-processors in accordance with Clause 7.7 and Clause 20.

Provider shall assist Customer, taking into account the nature of the Processing, in responding to verifiable consumer requests under the applicable US State Privacy Laws by making available the functions of the Services for that purpose and, where those functions do not suffice, on Customer’s instruction through the Means of Communication.

Provider certifies that it understands the restrictions in this Part C and will comply with them.

The agreed list of Sub-processors for the purposes of Clause 7.7 is the Sub-processor List as in force on the date this DPA takes effect for Customer under the preamble, as subsequently updated in accordance with Clause 7.7 and this Clause 20.

Provider gives the notice required by Clause 7.7(a) by (i) publishing the intended change on the Sub-processor List, with the date on which it takes effect, and (ii) sending the notice by email to the address for legal notices in Customer’s Order Form and to any additional address Customer has registered for that purpose with Provider (registration is made by email to dpo@maestra.io or, where available, through the form on the Sub-processor List). Such an email is written notice under the Section of the SSA titled "Notices". Customer may add or change its additional addresses at any time in the same way; the Order Form address cannot be removed except by a change to the Order Form. Customer keeps the address for legal notices in its Order Form current through the Means of Communication.

Customer may object to an intended addition or replacement on reasonable grounds relating to the protection of Personal Data by written notice to Provider, stating those grounds, before the date on which the change takes effect. An objection that states no such grounds does not have the effects of this paragraph. The Parties shall discuss the objection in good faith. If the Parties do not resolve it before the date on which the change takes effect, either Party may, as its sole and exclusive remedy, terminate the SSA by written notice to the other Party given before that date, with effect from that date or a later date stated in the notice. Fees accrue to the effective date of termination, and the Section of the SSA titled "Effect of Termination or Expiration" applies to the Personal Data. Provider does not undertake to maintain alternative hosting or infrastructure for an objecting Customer, or to exclude Customer’s Personal Data from Processing through the Sub-processor concerned.

If Customer does not object before the date on which the change takes effect, Customer is deemed to have authorised the engagement.

The removal of a Sub-processor from the Sub-processor List and corrections to the description of an existing Sub-processor’s location or purpose are published on the Sub-processor List and do not require the notice in paragraph (b).

This Clause 20 applies to every Customer on both the US SSA and the EU SSA. Nothing in this Clause 20 reduces the rights in Clause 7.7.

Part A reproduces the standard contractual clauses of Commission Implementing Decision (EU) 2021/915 with the options selected, together with the additions in Clause 7.7(a) (shorter notice in the circumstances stated there), Clause 10(d) (Resultant Data) and Clause 10(e) (updates to the Annexes), which the Parties agree under Clause 2(b); Part A is not otherwise modified.

The Annexes to this DPA are updated in accordance with Clause 10(e), except that additions or replacements of Sub-processors follow Clause 7.7 and Clause 20.

The preamble, Parts B, C and D of this DPA are updated by Provider in the same way as the SSA, under Provider’s right to update the Agreement in the Section of the SSA titled "Amendment and Waiver": written notice not less than thirty (30) calendar days before the effective date, publication of the updated version at the URL of this DPA, prospective effect only, and Customer’s right to terminate for convenience before the effective date. Provider shall not use such an update to modify the SCCs (Clause 12(d)) or to detract from the rights of data subjects.

Exhibit C, the Sub-processor List and the Documentation are incorporated by reference and change in accordance with their own terms — the Section of Exhibit C titled "Updates" (including the notice it requires for changes to Default Collection), the section of the Sub-processor List titled "Updates to this list" and Clause 20, and the Documentation as released. A change to a document incorporated by reference is not an update to an Annex under Clause 10(e).

Prior versions of this DPA remain available at the archive link at the foot of this DPA.

Provider makes the following available to demonstrate compliance with this DPA: its current SOC 2 Type II report, on reasonable written request and subject to a customary non-disclosure agreement (the Section of Exhibit C titled "Security Programme"); Exhibit C; the Sub-processor List; and written responses, on a confidential basis, to reasonable requests for information that Customer needs to confirm Provider’s compliance with this DPA, including information-security, due-diligence and audit questionnaires, not more than once in any calendar year.

Customer exercises its rights under Clause 7.6(c) and (d) and Clause 17(e) first through the information in paragraph (a). Where that information does not demonstrate compliance on a point, or where there are indications of non-compliance, Customer or an independent auditor mandated by Customer and bound by confidentiality may audit the Processing activities covered by this DPA, on-site or remotely, not more than once in any calendar year unless Data Protection Laws or a competent supervisory authority require otherwise, on at least thirty (30) days' written notice with a proposed scope and plan. The Parties agree the scope, timing and duration of the audit before it starts; the audit is conducted during Provider’s normal business hours and in a manner that does not unreasonably interfere with Provider’s operations or the security of other customers' data. Provider may object to an auditor that is not suitably qualified or independent, is a competitor of Provider or is otherwise manifestly unsuitable, in which case Customer appoints another auditor. An audit report is Confidential Information of Provider under the Section of the SSA titled "Confidentiality".

An audit under paragraph (b) is at Customer’s expense. Customer bears its own costs and reimburses Provider for the time and expenses Provider reasonably incurs in preparing for and supporting the audit, at Provider’s then-current professional services rates notified in advance, unless the audit reveals a material breach of this DPA by Provider, in which case Provider bears its own costs. Provider’s cooperation under paragraph (a) is at no charge.

The Processing of Personal Data by the AI Features is governed by the Section of the SSA titled "AI Features" and by this DPA. Provider does not use Personal Data to train its own artificial-intelligence or machine-learning models, as stated in that Section.

Provider Personnel may use third-party artificial-intelligence tools and services to service Customer’s account and to operate and support the Services, including to configure the Services on Customer’s instructions. Any such tool or service that Processes Personal Data is a Sub-processor, is listed on the Sub-processor List and is engaged under Clause 7.7(b) on terms that prohibit the use of Personal Data for the tool provider’s own purposes, including the training of its models.

Where Customer’s Affiliates use the Services under Customer’s Order Form, Customer enters into this DPA on behalf of itself and those Affiliates, which are "Customer" for the purposes of this DPA in respect of the Personal Data Processed on their behalf.

Customer alone exercises the rights and remedies under this DPA for itself and its Affiliates, and Provider’s notices and communications to Customer discharge any obligation to notify or communicate with a Customer Affiliate. A Customer Affiliate that is entitled under Data Protection Laws to enforce this DPA directly does so through Customer, unless Data Protection Laws require otherwise.

This DPA forms part of the SSA and is incorporated by reference into it, and forms part of the Agreement between the Parties.

This DPA replaces any data-processing terms previously in force between the Parties for the same Processing, including Annex 1 (EU) — Data Processing Agreement version 1.1 and earlier versions and Annex 2 (UK) — UK Addendum to the Data Processing Agreement version B1.0, from the date this DPA takes effect for Customer under the preamble. It does not modify any term expressly negotiated by the Parties and recorded in a signed Order Form or addendum, which continues to apply in accordance with the provision of the Section of the SSA titled "Amendment and Waiver" that preserves terms expressly negotiated by the Parties and recorded in a signed Order Form or addendum.

Where this DPA replaces version 1.1, the Clauses of Part A are the same standard contractual clauses, with the same selections, as in version 1.1; the Annexes are updated under Clause 10(e); and Parts B, C and D take effect under Clause 21(c). Where the SSA is amended in the same notice, the amendment of the SSA takes effect immediately before this DPA.