MYDATASPORT.COM TERMS AND CONDITIONS

1. TERMS AND CONDITIONS OF THE SERVICE

1. The following Terms and Conditions (“Terms”) together with the Order, the SLA, and the DPA (as defined below) constitute the subscription agreement entered into you (“Customer”) and the MYDATASPORT.COM entity (“MYDATA”) and govern your access to and use of: (i) the MYDATASPORT.COM software platform and the documentation and the functions performed, as well as any corrections, updates, and upgrades thereto (“Software”) and any other maintenance and support thereto (also subject to the SLA that will have priority in any case of inconsistency with these Terms); (ii) the MYDATASPORT.COM devices and any other related equipment that MYDATASPORT.COM may provide you. 2. We may change these Terms, our privacy policy, or our cookies policy at any time. If there are any changes in our Terms, we will notify you through our Services or the email account you are registered to give you the opportunity to revise the changes before they are made. If you do not agree to any of such changes, you may terminate your account. The use of our services after the changes of our terms was published or notified, will be treated, to all purposes, as the acceptance of the updated Terms.

2. CAPACITY OF ACCEPTANCE

1. By accessing and/or using any of our Services, you claim to be authorized to agree to these Terms on behalf of the Customer

2. You explicitly acknowledge and agree that you understood and abide by and be legally bound by our Terms and Privacy Policy (as defined below). If you do not agree, you shouldn’t use our Services.

3. ORDER

1. The Services are requested under an Order subscribed to the present date (“Order”). The Order is binding once MYDATASPORT.COM agrees in writing. MYDATASPORT.COM shall not be responsible to provide any Service or product that is not detailed in the corresponding Order.

4. USE OF SERVICES

1. Once you Will subscribe in the corresponding Order, the Customer will have the right to use the Services during the Time (as defined below) subject to these Terms. MYDATASPORT.COM will provide the Services, subject to these Terms and according to the information, the parameters, and established criteria in your Order (if applicable).

2. For that purpose, subject to these Terms and Conditions and the payment of applicable fees, MYDATASPORT.COM will grant you a personal, revocable, non-exclusive, non-assignable, and non-transferable license to have access and use the Services (and the data included in the Application) and to allow Professional Users (as defined below) to have access and use the Software, as well as to allow Authorized Users to use the Application owned by MYDATASPORT.COM (hereinafter “Application”), in a device that the corresponding Authorized User owns or controls, subject to their acceptance of the terms and condition applicable to such Application. “Authorized Users” refers to: (i) all the players of a team (every individual, a “Member of the team”), property controlled or operated by the Customer (each member, a “team”); and (ii) members of the professional personal Team (such as coaches and advisors) (“Professional Users”).

3. MYDATASPORT.COM may change, suspend or withdraw any Service or Application, or change and modify future rates and commissions, at our option. To the extent permitted by law, these changes will become effective when they are notified to you. MYDATASPORT.COM may change or withdraw any of the Services or the Application. We cannot ensure that we will store or continue showing the information or content you have published. The Service and/or Application is not considered a storage service. You agree that we do not have the obligation to store, preserve and deliver a copy of any content or information that you or other people provide us, except to the extent permitted by law and as stated in our Privacy Policy.

4. Between you and MYDATASPORT.COM, you are the owner of the content and the information you provide or share in the Services. You only grant MYDATASPORT.COM and our subsidiaries the following non-exclusive license: A transferable, geographically unlimited right and subject to sublicenses to use, copy, modify, distribute, publish and process the information and contents that you provide us through our Services and third-party services without any additional consent, notification, or compensation to you or third-parties. These rights are limited the following way: i. You can terminate this license for a specific content deleting such content from the Services or deactivating your account unless (a) you have shared this content with other people as part of the Service and at the same time they have copied, re-shared, or stored and (b) during the reasonable period that takes to withdraw the content from the backup and other systems. ii. Even though we may edit and make changes of format in your content (such as translate it, modify the size, design, or type of file, or remove metadata) we will not modify its message. iii. As you are the owner of your content and information, and we only have non-exclusive rights regarding thereof, you may choose to share it with third parties. You agree with MYDATASPORT.COM that if the content includes personal information it will remain subject to our Privacy Policy. Likewise, you agree with MYDATASPORT.COM that we can have access, store, process, and use any information or personal information that you provide according to our Privacy Policy terms and your choices (including the settings). By submitting suggestions or other comments to MYDATASPORT.COM about our Services, you agree that MYDATASPORT.COM uses and share such comments for any purpose without any compensation to you. You commit to providing us only information and content you have a right and that the information in your MYDATASPORT.COM profile is true. You agree to only provide content and information that is not contrary to the law or rights of any person (including intellectual property rights). You also agree to provide true information on your profile. MYDATASPORT.COM may be required by law to withdraw certain information o content in some countries. We will respect the settings you do regarding who can see your information and content.

5. Your use of the content and information of other people shared in our Services run at your own risk. Other third-parties may provide their own products and services through our Services but we are not responsible for the activities third-parties may do. By using the Services, you may find inaccurate, incomplete, outdated, misleading, illegal, offensive, or harmful information or content. MYDATASPORT.COM does not usually revise the content provided by its members or other people. You agree that you are not responsible for the content or information of other people (including other members). We cannot always avoid the misuse of our Services and you agree that we are not responsible for such use. We also acknowledge the risk that you or your company may be wrongfully associated with the content of other people. You are responsible to decide whether you want to enter or use third-party applications or websites that have a link in our Services. If you allow a third-party application or website to authenticate you or log on to your MYDATASPORT.COM account, such application or website may have access to your information and your contacts’ information. The third-party applications and websites have their own legal terms and privacy policy and you may be granting permission to third parties to use your information in a way that we would not use it. Except for limited cases in which the relevant legislation requires, MYDATASPORT.COM is not responsible for these applications and websites. Use them at your own risk.

6. Hereby, you agree and acknowledge that MYDATASPORT.COM may provide different Software and/or Application versions that may contain different characteristics and features according to our responsibility.

5. ACCOUNT

1. To use the Software and Application, MYDATASPORT.COM will create an individual account for each Customer in the Software and Application .

2. Hereby, the Customer shall: a. Provide MYDATASPORT.COM precise and complete login information; b. Not to allow that anyone but you have access or use your Account, not create any Account for any other third-party and not use a third-party account without your permission; c. Keep your Account password safe and d. Immediately notify MYDATASPORT.COM about any security violation or unauthorized use of your Account. You are still the only one responsible for the activity that occurs on your Account. 1. To use the Application, each of your Authorized Users have to create a user account (“User Account”). 2. Hereby, you agree to continue being responsible for the activities made as regards the Users’ accounts of your Authorized Users and to make sure that they will comply with the applicable obligations.

6. REPORTS

1. The Services allow you to have access to the results, information, and reports obtained and created as regards the monitoring and analysis of DATA provided through them (“Reports”). The Reports may include without limitation data and statistics about the individual and group training of the Members, details of the development of the Members of the Customer’s Teams and comparisons between the Members of the Team

7. USE OBLIGATIONS OF THE SERVICES

1. You shall not allow Authorized Users or any third parties do the following proceedings:

a. Use or create a false identity, fake your identity, create a profile for someone it is not you (a natural person) or an Authorized User, neither use nor try to use other people’s account;

b. Copying, distributing, disseminating, renting, leasing, providing, using for time-share services or service offices, exporting, modifying, adapting, translating, improving, personalizing or creating derivative Service works or any part thereof;

c. Reverse engineering, decompiling, disassembling, or attempting to derive the source code of the Software or any part thereof;

d. Deleting or distorting any proprietary notices, labels, legends in the Services;

e. Using any automated means to have access or use the Services neither avoid nor deactivate any technological or safety feature of the Services;

f. Using, sending, uploading, publishing, transmitting, or inputting any device, code, routine or another component (including bots, virus, etc., among others) that interferes (or intends to interfere) with the operation or integrity of the Services, or illegal, libellous, deceiving, obscene, fraudulent, harassing, pornographic or abusive content;

g. Using the Services to design or develop any product or service that competes with our Services;

h. Using the Services for any illegal or fraudulent purpose, to violate these Terms or infringe or unduly misappropriate any intellectual property right, privacy, or third-party advertisements, such as copyrights, patents, trademarks, trade secrets, or other property rights. For example, do not copy or distribute (except through the share function available);

i. Disclosing information that you do not have the right to share (such as confidential third-party information, including your company);

j. Carrying out any action that imposes or may impose, as determined, in the sole discretion of MYDATASPORT.COM, a disproportionately heavy load of incoming requests in the Services infrastructure;

k. Violating or abusing the password protections that operate the Software and/or Application access;

l. Using or directing the Services to interface with an IP or device that is not expressly authorized to do so; and/or m. Using directly or indirectly the Services to launch, spread, participate, conduct or try any attack, hack or send bandwidth saturation, malicious network messages, or potentially harmful to any device.

2. You shall do the following procedures as well as guarantee that the Authorized Users will carry them out:

a. Comply with all relevant laws, including, among others, privacy laws, intellectual property laws, antispam laws, export control laws, tax matter laws, and other regulatory requirements.

b. Provide us accurate and keep it updated.

c. Use your real name on your profile.

d. Use the Services professionally. e. Comply with all the obligations undertaken in these Terms at all times.

3. MYDATASPORT.COM reserves the right to restrict, suspend or terminate your account if it considers that you have breached these Terms, the law, or misuse the Services.

8. THIRD-PARTY SOFTWARE

1. You expressly acknowledge that the Software and/or Application may include third-party components (“Third-Party Software”), that you should only use with the Software and/or Application and it will not be used for any other purposes without the prior written consent of MYDATASPORT.COM. Such Third-Party Software is provided “as is” without warranties of any kind and subject to the license terms attached to the Third-Party Software, available at www,mydatasport.com .

9. PAYMENTS

1. In consideration for the Services, you shall pay applicable non-refundable subscription fees (if any) specified in the Order, taking into account the established periods in it. Unless otherwise provided by the Order, every fee shall be paid monthly and they shall be payable within thirty (30) days following the invoice date. Late payment will be subject to a late payment fee charge equal to 1,8% monthly or if it is less, the maximum amount allowed by applicable law. All the amounts payable shall not be subject to any compensation or deduction. All fees do not include taxes, fees, and similar charges imposed by the government and you are responsible for the payment of that whole amount including sales taxes, Value-Added Tax (VAT), withholding tax, exports and imports, and other tariffs imposed by any government or agency related to the Services.

10. INTELLECTUAL PROPERTY RIGHTS

1. You acknowledge that MYDATASPORT.COM owns solely and exclusively each and every right, title, and interests of the provided Services including all the intellectual property rights thereof, and including the modifications, reports or derived and/or compiled data thereof, regardless of whether they are provided or developed by any of the parties. MYDATASPORT.COM may make such data available to the Customer or Authorized Users of the Application and/or Software according to the previous Section 4 (“Use Rights”). There is nothing in this Agreement that establishes a waiver of Oliver´s intellectual property rights, under any law.

2. The trademarks and logos used in the Services are the trademarks of their respective owners. MYDATASPORT.COM, the logos and other MYDATASPORT.COM brands, the service marks, the graphics, and logos used for our Services are MYDATASPORT.COM registered trademarks.

11. FEEDBACK

1. If you contact MYDATASPORT.COM to share suggestions or comments about the Services, which may include suggestions or comments about customizations, features, upgrades, modifications, corrections, derivatives, or extensions (“Comments”), such Comments will be considered exclusive MYDATASPORT.COM property and it shall be free to adopt those comments for any of its products or services and use it in any other way. Olive shall disclose, reproduce, license or distribute and exploit those Comments if it considers it appropriate without obligation or constraints of any kind on account of intellectual property rights or other rights. Hereby, you waive any right of the Comments, including, among others, any right to royalties or any other consideration and you commit to deal with the Comments as MYDATASPORT.COM Confidential Information (as defined below).

12. MODIFICATIONS

1. At any time, MYDATASPORT.COM reserves the right to:

1. interrupt, change, upgrade, or modify the Services or any aspect or feature of them; and

2. remove or restrict its access or any aspect or feature of the Services.

MYDATASPORT.COM PRIVACY POLICY

1. PRIVACY

1. Both parties commit to comply with the EU-Regulation 2016/679 determined by the European Parliament and the Council, of 27 April 2017 (GDPR) and the Organic Law 3/2018, of December 5, Protection of Personal Data and Guarantee of Digital Rights and current Spanish legislation. The personal information provided by the Customer in the acceptance of these Terms will be included in the corresponding register, owned by MYDATASPORT.COM. Such personal information shall solely be treated to enable the execution of the Services and to maintain a commercial relationship which implies sending commercial communications. The legitimacy of data processing is based on the relationship established, the compliance of the legal obligations applicable, and the legitimate interest of the sending of communications. Data will be kept during this relationship and the necessary years to fulfill legal obligations. Data could be transferred to the Tributary Agency and other public administrations for the compliance of tax obligations; as well as, to financial entities for the collection management and payments. Users holding personal data obtained in these Terms may exercise their right of access, rectification, opposition, limitation, deletion, portability, and their right of not being the object of any automated decisions by heading to the included addresses in this contract as the domicile of the parties involved. Furthermore, you can complain in the Spanish Data Protection Agency (www.aepd.es), especially if you failed to obtain satisfaction when exercising your rights.

2. The use of Services and MYDATASPORT.COM Application imply the processing of users’ personal data that in some cases will include physiological and specially protected data. The Customer is the owner of the data and responsible for processing personal data regarding the execution of these Terms. MYDATASPORT.COM acquires the capacity of Processor regarding personal data that collects and processes for the execution of the service. MYDATASPORT.COM shall be responsible for the data as long as it has the consent of users for its own purposes, properly informed. MYDATASPORT.COM will duly process anonymized data for the improvements of its products and services. The Customer, as responsible for the personal data previously described, is solely responsible for informing and requesting the express and explicit consent, as the case may be, of the Service and Application users. MYDATASPORT.COM, on behalf of the customer, shall provide information about data processing in the Application privacy policy. In accordance with the provisions in Article 28 of the General Data Protection Regulation, 2016/679 27 April (henceforth, RGPD), MYDATASPORT.COM is authorized, and it agrees, to have access to personal data of their ownership and both parties will be subject to the clauses in Annex 1.

2. CONFIDENTIALITY

1. Each party compromises to process confidentially and to keep Confidential Information a secret. They would only use it to comply with their obligations derived from these Terms.

2. Each party may reveal the other party’s Confidential Information to employees or agents of any of the companies of their groups in which its access may be necessary only in order to comply with their obligations and fulfill their rights conferred pursuant in these Terms. In any case, previously to reveal such information, each employee or agent shall be informed of their duty and obligation to keep Confidential Information a secret and do not use that information for other purposes different from the ones provided in the derived contracts of these Terms. Each party shall take the necessary measure to ensure that these employees and agents comply with the confidential terms and conditions of this clause.

3. Confidential Information will not include the information that the receiving party may sufficiently prove and in writing that:

a. At the moment it was revealed, such information was already known by the receiving party and outside the framework of its confidentiality obligation;

b. It was accessible to the general public and available in the public domain at the moment it was disclosed to the receiving party;

c. It was accessible to the general public or it became available in the public domain after its disclosure without the receiving party failing to comply with these Terms, either by act or omission; d. It was revealed to the receiving party, except for a confidential obligation to a third-party, by a third-party that did not have a confidential obligation with the receiving party;

e. Its dissemination was approved by the disclosing party in a written authorization; f. It was independently made by employees and contractors of the receiving party or any of its affiliates without using any Confidential Information of the other party.

1. Each party shall use or disseminate the other party Confidential Information, as long as such usage or dissemination is reasonably required to defend themselves in a trial, to fulfill the applicable governmental regulations or submit information to tax authorities or other governmental authorities, to comply with these Terms or exercise in any other way their rights thereunder, as long as the revealing party, who is forced to disseminate such Confidential Information, report well in advance the other party and make every effort to ensure the confidential processing of such information before its dissemination.

2. If one party develops or uses a product or procedure in which, in the other Party’s reasonable view and as a proof thereof, the usage of any Confidential Information could have been involved, the receiving party of such Confidential Information shall provide, a written petition by the disclosing party, the necessary reasonable information to state that such Confidential Information has not been used or disclosed with the purpose of developing or using such product or procedure.

3. Each party shall notify the other party (or any of the employees related to the compliance of these Terms) if it is aware of any unauthorized disclosure of any Confidential Information and will provide reasonable assistance.

4. The previous confidentiality obligations about the received Confidential Information shall remain in force during the period in which it remains confidential, even after the termination of these Terms.

3. LIMITATION OF LIABILITY

1. Under no circumstances, will MYDATASPORT.COM be liable for any special, incidental, punitive, or consequential, or the loss of data/benefits, use of money, disruption in the use or availability of data, stop other works, or impairment losses on the assets, fines or other sanctions for non-compliance arising out of or under this agreement or use of the Services and/or Application, whether such responsibility arises from any claim based on agreement, warranty, Confidential Information, aggravation (including negligence), including any injury or any incident the player may have suffered using the Services and/or Application without the supervision of a qualified coach, strict responsibility or otherwise, even if MYDATASPORT.COM and its members has been notified about this damage and even if these solutions do not remedy its essential aims.

4. INDEMNITY

1. The Customer shall fully hold MYDATASPORT.COM harmless regarding all damages, responsibility, lawsuits, obligations, trials, judgments, and expenses of any kind that may incur as a consequence of third-party claims that may arise from:

1. any data or information provided by the Customer or its Authorized Users;

2. any claim against MYDATASPORT.COM by anyAuthorized User;

3. the violation of any applicable law or regulation (including, among others, applicable privacy law) by the Customer or Authorized User;

4. the violation of any third-party rights, including, among others, any intellectual property rights or privacy rights by the Customer or Authorized User;

5. the Customer or Authorized User’s failure to comply with the privacy obligations applicable to them;

1. Without abolishing or excusing its obligations under this Section, MYDATASPORT.COM reserves the right, (in charge) but does not have any obligation of assuming the defense and exclusive control of any matter subject to any compensation from its part if desired. You agree not to settle any matter subject to indemnification by you without the written approval by MYDATASPORT.COM.

5. TERM AND TERMINATION

1. These Terms will come into force on the date specified in the Order and shall remain in force during the initial period established in the Terms (“Initial Term”). Once the Initial Term finishes and is subject to the fees agreed by the Customer as specified in the Order, the Terms shall automatically be renewed for successive periods equal to the Initial Term, unless any of the parties provide to the other party a written notice about its intention not to renew for at least 60 days before the end of the applicable term at that moment (the Initial Term and each extension shall be collectively referred as “Term”)).

2. Nevertheless: a. MYDATASPORT.COM may terminate these Terms 60 days’ prior written notice to you; and/or b. Any of the parties may immediately terminate these Terms, by written notice to the other party:

(i) if the other party has not fulfilled substantially these Terms and has not remedied such breach within 30 days after you receive the written notification about it; or

(ii) if such party becomes insolvent or carries out a transfer benefiting the creditor or a similar transfer that proves the insolvency or if he/she undergoes or allows the initiation of any kind of insolvency procedure, administration or judicial administration or if it has any insolvency petition filed against he/she, whose petition is not rejected within 60 days after he/she or it has a designated trustee, administrator or receiver for a significant part of your business or assets. The party subject to any of the previous events detailed in section

(ii) shall immediately notify the other party in writing.

1. After the termination of the Terms, you shall (and also the Authorized User) cease every access or use of the Services and/or Application. 2. After the termination of these Terms, you shall not have access to the Reports or other contents and stored data or provided in the Services, whether provided for you or generated as a result of the Services (“Materials”). MYDATASPORT.COM reserves the right to permanently remove any Material or other content that may remain in your Customer Account or in any Users Account of your Authorized Users at any time after the termination. You agree to resign to any legal or equitable right or appeal that may have against MYDATASPORT.COM regarding such Materials or other removed content.

6. TRANSFER

1. These Terms, as well as the rights and licenses granted hereunder, shall not be transferred or ceded by you, but may be transferred by MYDATASPORT.COM or any third-party, without restrictions but subject to previous notification of such transfer.

7. MODIFICATION TO THIS AGREEMENT

1. MYDATASPORT.COM reserves the right to modify these Terms at any time by publishing the adapted version of it on the MYDATASPORT.COM website available in: - https://mydatasport.com/terms-and-conditions. Such modifications shall enter into force ten (10) days after the previous notice of it and the continued use of the Services or any part of them, thereafter, shall imply the agreement of them.

8. APPLICABLE LAW

1. These Terms shall govern and construe according to the Spanish legislation.

2. To solve any discrepancies that may arise interpreting or executing these Terms, both parties, resigning to any other jurisdiction that may correspond them, are expressly submitted to the jurisdiction and competence of the Courts and Tribunals of Barcelona.

9. GENERAL

1. If any agreement of these Terms is declared, totally or partially, ineffective or invalid, such invalidity or ineffectiveness will affect only that provision or part thereof that is invalid or ineffective, and the Terms shall remain in force in everything else, not including such provision or part thereof that is affected. For this purpose, these Terms shall cease exclusively based on the ineffective or invalid disposition, and any other part or disposition thereof shall be cancelled, invalidated, damaged, or affected by such invalidity or ineffectiveness, unless it affects the Terms in an integral way for being essential for this investment.

2. These Terms, and any other legal notice published by MYDATASPORT.COM in relation to the Services, shall represent fully agreement between you and MYDATASPORT.COM as regards the Services

3. No waiver or any other action derived from these Terms shall be deemed a continuing or additional waiver of such term or any other term, and the fact that a party does not enforce any right or disposition in these Terms, this shall not be deemed a waiver of such right or disposition.

YOU AGREE THAT ANY CAUSE OF ACTION THAT MAY ARISE FROM OR RELATED TO THE SERVICES MUST COMMENCE WITHIN ONE (1) YEAR AFTER THE CAUSE OF ACTION HAS COMPLIED; OTHERWISE, SUCH CAUSE OF ACTION IS PERMANENTLY FORBIDDEN.

________________________________________

ANNEX 1

- PERSONAL DATA PROCESSING For the proper provision of the contracted service, it is necessary that MYDATASPORT.COM acts as PROCESSOR and has access to personal data, in which its processing is the responsibility of the Customer, CONTROLER and that MYDATASPORT.COM makes the processing on behalf of and for the Customer. The access to personal data of the PROCESSOR on behalf of CONTROLLER is abided to the legal provisions of the REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter GDPR) as well as by Organic Law 3/2018 of December 5 on Protection of Personal Data and Guarantee of Digital Rights (hereinafter, OLPPDGDR) as long as it is not in opposition to GDPR, as well as any other regulations that may be enacted in the future about this matter and supplement or replace the current ones. Thus, in accordance with article 28 of the GDPR, both parties freely agree to regulate the access and process of personal data that are provided by the CONTROLLER in accordance with the following ________________________________________

CLAUSES

CLAUSE 1.

– PURPOSE The purpose of this Contract is to authorize the PROCESSOR to process on behalf of the CONTROLLER the personal data necessary to provide the contracted service and define the conditions in which the PROCESSOR will process personal data he/she has access during the execution, establishing the obligations and responsibilities derived from the data processing that the PROCESSOR do exclusively to comply with this contract.

CLAUSE 2

– DESCRIPTION OF THE DATA PROCESSING The PROCESSOR is authorized to process, on behalf of the CONTROLLER, the necessary personal data to fulfill the provision of the contracted services. The nature of the processing operation in charge, automatized or not, are marked below: Collection Registration Structuring Extraction Access Usage Confrontation Interconnection Restriction Maintenance Modification Communication through transmission Dissemination Erasure Destruction Communication Others Categories of data subjects: Workers Candidates Suppliers Customers Others: Players, coaches, and technical staff Categories of personal data: Identifying Personal characteristics Social conditions Professional occupation Academic and professional Economic and financial Transactions in goods and services Business information Sensitive data Others Sensitive data correspond to health and physiological data

CLAUSE 3

– NATURE AND PURPOSE OF PROCESSING PERSONAL DATA.

The PROCESSOR compromises to process personal data in which it collects or has access as a consequence of the fulfillment of the provision of the services contracted, according to the processing that follows the documented instructions that the CONTROLLER indicates at any time and the applicable legislation, only doing the actions required to correctly develop the purpose of the provision of services and do not apply or use with a different purpose than the one mentioned in these Terms and Conditions.

It is recognized that the PROCESSOR shall use the data for personal purposes and be properly anonymized. The instructions for this processing are the ones detailed in the provision of the services contracted. The PROCESSOR shall not transmit the data to third parties, not even for its conservation, unless the processor has the express authorization of the CONTROLLER, in the legally admissible scenarios.

The PROCESSOR shall follow the CONTROLLERS’ instructions including the international personal data transference to a third country or international organization, unless the PROCESSOR is obliged under the Union or Member State law that applies to the PROCESSOR, in which case the PROCESSOR shall inform the CONTROLLER of such legal requirement before the processing, unless such Right prohibits it for reasons of substantial public interest.

The PROCESSOR shall immediately inform the CONTROLLER if, in its opinion, an instruction infringes the RGDP or any other Union or Member State law data protection provisions applicable to the PROCESSOR. The CONTROLLER can authorize the dissemination of personal data processing by the PROCESSOR to another processor. Such authorization shall involve the previous notice and in writing of the new processor to whom the data has to be transferred, the data transferred, and the security measures in such transfer.

CLAUSE 4

– TERM This contract shall come into force the date on which the provision of services is hired, coming into force until its resolution. Likewise, the confidentiality obligation will last indefinitely, while the confidential data keeps its non-disclosure nature, since the moment the Contract is signed.

CLAUSE 5

- OBLIGATIONS OF THE CONTROLLER. The CONTROLLER agrees to the following: a. Ensuring the PROCESSOR complies with the previous obligations in this Contract and supervising the data processing by the PROCESSOR. b. Complying with the obligations that correspond as CONTROLLER by implementing the current legislation.

CLAUSE 6

– OBLIGATIONS OF THE PROCESSOR The PROCESSOR shall: a) Registartion of categories Keep a written record of all the categories of processing activities performed on behalf of the CONTROLLER, which shall contain:

1. Name and contact details of the processor, sub-processor, and of every controller on whose behalf the former is acting and, where applicable, the representative of the controller or of the processor and the data protection officer.

2. The categories of processing conducted by the controller.

3. The international transfers of personal data to a third country or international organization, including the identification of such third country or international organization and in the case of the transfers mentioned in the article 49 section 1, second paragraph of the RGPD, the documentation of adequate safeguards.

4. A general description of security technical and organizational measures implemented.

b) Guarantee of compliance of the authorized people processing personal data There will only have access to the personal data of the authorized people who need to have access in order to fulfill the functions related to the contracted services and follow the CONTROLLER’s instructions. Provide and demand the authorized people to comply with the processing of personal data, the obligations in this Contract and warn them about the confidentiality of the information and their responsibility in case of dissemination. And guarantee that the authorized people compromise, expressly and in writing, to keep confidentiality and comply with the corresponding security measures. The documents regarding these obligations are at the CONTROLLER’s disposal. Ensure that the authorized people will have the necessary training regarding personal data protection to process data. If the authorized people do the hired services in the CONTROLLER’s premises or remotely, they shall comply with the norms, procedures, and other dispositions of the CONTROLLER’s security policies.

c) Rights of the data subjects When the people concerned exercise the rights to access, rectification, erasure and objection, restriction of processing, data portability, and the right to not to be the object of automated decision-making before the PROCESSOR, he/she shall inform this to the CONTROLLER as detailed in the Terms and Conditions. The communication shall be sent immediately and in no case after 5 working days following the date on which the request is received. The PROCESSOR shall assist the CONTROLLER, taking into account the processing nature, through appropriate technical and organizational measures and any information that may be relevant to solve the petition.

d) Notice of violations to data security The PROCESSOR shall give notice to the CONTROLLER, prior to the maximum term of seventy-two (72) hours, this notice shall be done through the email account mentioned in the Terms and Conditions, of any security violations of the personal data he/she becomes aware of, together with all further relevant information for the documentation and communication of the incident. It shall provide, at least, the following information:

1. Description of the nature of the security violation of personal data, including, if possible, the categories and the approximate number of data subjects concerned, and the categories and the approximate number of personal data records concerned.

2. The name and contact details of the PROCESSOR or other contact to obtain further information.

3. Description of the potential consequences of the security violation of personal data.

4. Description of the measures adopted or put forward to remedy the security violation of personal data, including, if applicable, the measures used to mitigate potential negative effects.

e) Security measures In order to maintain the security and avoid the processing from violating the General Data Protection Regulation (RGPD) established, the PROCESSOR shall evaluate, at the commence of the provision of services, the inherent risks to the processing and take measures to mitigate them. For this, the PROCESSOR shall apply the necessary technical and organizational measures to mitigate the risks in order to ensure security and avoid that the processing violates the General Data Protection Regulation established. The PROCESSOR is obliged to make available to the CONTROLLER, when required, all the necessary information related to security measures. Likewise, the PROCESSOR shall provide the performances of control audits, regarding the security measures, by the CONTROLLER, as long as they are requested in a reasonable time. In any case, the PROCESSOR will implement the detailed measures in the document or security protocol and implement measures to:

1. Ensure the confidentiality, integrity, availability, and permanent resiliency of the processing systems and services.

2. Restore the availability and access to personal data quickly, in the event of a physical or technical incident.

3. Test, assess, and evaluate, regularly, the effectiveness of technical and organizational measures to ensure the security of the processing.

4. Pseudonymize and encrypt personal data, when appropriate

f) PROCESSOR guarantees Make available to the CONTROLLER the necessary documentation to demonstrate compliance with its obligations established in these Terms and Conditions and to contribute to the performance of audits or inspections conducted by the CONTROLLER or other auditor authorized by the controller

g) PROCESSOR assistance as regards the CONTROLLERS obligations Offer the CONTROLLER support in the performance of impact assessments related to data protection and in the performance of prior consultations to the supervisory authority, when appropriate

h) Destiny of data Once the provision of services of the main agreement has complied, the PROCESSOR compromises, at the choice of the CONTROLLER, to;

1. Destroy personal data.

2. Return all the personal data to the CONTROLLER.

3. Return the personal data to another processor designated in writing by the CONTROLLER. The return of the data means the destruction of every copy, in any support or existing document in the PROCESSORS’ information system and adopt security measures to avoid theft, loss or, unauthorized access to the data during transport. In case of theft, the PROCESSOR guarantees the necessary measures to avoid access to the information or its later recovery and shall certify their destruction in writing and deliver the corresponding certificate to the CONTROLLER. Notwithstanding the above, PROCESSOR may keep the personal data duly blocked during the period in which any responsibilities regarding its relationship to the CONTROLLER may be derived, according to the current legislation

CLAUSE 7

– SUBCONTRACTING The DATA PROCESSING MANAGER shall not engage third-party subcontractors In case it is necessary to subcontract any processing, the PROCESSOR shall previously inform this in writing to the CONTROLLER specifying the processing he/she wants to contract indicating in a clear and unmistakable manner the subcontractor company and its contact details. The subcontracting may occur previously authorized in writing to the CONTROLLER. In any case, the data processing of the subcontractor shall comply with the instructions imparted by the CONTROLLER, and the PROCESSOR must enter into a contract with the subcontractor company as provided in these Terms and Conditions and in accordance with the provisions in Article 28 of the RGPD, compromising the subcontractor, expressly and in writing, to assume the same established obligations as the PROCESSOR under this contract. Should the subprocessor commit breach, the PROCESSOR shall remain fully liable before the CONTROLLER for the performance of the obligations.