mParticle Platform Services Agreement

This mParticle Platform Services Agreement, including any exhibits hereto (this “Agreement”), is by and between mParticle, Inc., a corporation organized under the laws of the State of Delaware, U.S.A. (“mParticle”) with a mailing address at 99 Wall Street, Suite 630, New York, New York 10005, U.S.A., and the customer of the applicable Order Form incorporating this Agreement (“Customer” or “You”). Each of mParticle and Customer may be referred to herein individually as a “Party” or collectively as the “Parties.” By executing an Order Form that references this Agreement, You agree to all the provisions herein. If You are accepting this agreement on behalf of a company or other legal entity (whether as an authorized employee, attorney, or agent), you represent that You have the authority to bind such entity and its affiliates to this agreement. If You do not have such authority, or if You do not agree with this Agreement, You must not accept this Agreement and may not use the services.

BACKGROUND

mParticle is a software technology company that has developed a software-as-a-service platform enabling enterprises to (1) collect, organize, synchronize and analyze data from applications, websites, connected devices, and offline data sources and (2) distribute such data to various service providers, including analytics, artificial intelligence, monetization, data warehousing and other services. As such, mParticle functions as a core data and services orchestration layer for enterprises. Customer desires to subscribe to the mParticle Platform (as defined below), and mParticle is willing to provide the mParticle Platform, in accordance with this Agreement, which consists of the Terms and Conditions below, all exhibits and attachments hereto and any applicable Order Form(s) (an “Order”).

TERMS AND CONDITIONS

1. PROVISION AND USE OF THE MPARTICLE PLATFORM

1.1 mParticle Platform. Subject to and in consideration for the Customer paying the Fees (as defined below), mParticle will make its software platform, consisting of the core customer data service (the “mParticle Service”), data analytics service (the “Analytics Service”) and artificial intelligence service (the “Cortex Service”), available to Customer (the “mParticle Platform”) pursuant to this Agreement and the applicable Order during the Term (as defined below). For purpose of clarity, the “mParticle Platform” shall include the mParticle SDK and mParticle APIs (each as defined below). Once Customer identifies an administrative user name and password and such administrative account is provisioned, Customer shall have access to and can utilize the mParticle Platform. Subject to the terms and conditions of this Agreement, mParticle hereby grants Customer a limited, non-exclusive, non-transferable, non-sublicensable right and license to access and use the mParticle Platform during the Term (as defined below) solely for Customer’s internal business purposes. mParticle will provide the mParticle Platform in accordance with Applicable Laws (as defined below) related to the provision of the mParticle Platform to mParticle’s customers generally, and without regard for Customer’s particular use of the mParticle Platform, subject to Customer’s use in accordance with this Agreement. For purposes of this Agreement, “Applicable Laws” means all applicable laws, rules, regulations related to Customer’s use and mParticle’s provision of the mParticle Platform.

1.2 mParticle SDK. Subject to and in consideration for the Customer paying the Fees (as defined below), mParticle will make its software development kit (in object code format only) available to Customer via the mParticle Platform (the “mParticle SDK”). Subject to the terms and conditions of this Agreement, mParticle hereby grants Customer a limited, non-exclusive, non-transferable, non-sublicensable right and license during the Term to (a) download and use the mParticle SDK for Customer’s internal business purposes; (b) incorporate the mParticle SDK into Customer’s web and/or mobile applications and connected devices set forth in the Order (collectively, the “Supported Customer Properties”); (c) distribute and otherwise make available the mParticle SDK as incorporated in the Supported Customer Properties; and (d) send data server-to-server via mParticle’s Application Programming Interfaces (“mParticle APIs”).

1.3 License Grant Restrictions and Requirements. The following restrictions and requirements shall apply to Customer’s use of the mParticle Platform:

1. (a) Restricted Access. Unless otherwise authorized by mParticle in writing, the Customer shall only provide access to the mParticle Platform to persons who are either employees or contractors of Customer or its Affiliates (subject to Section 1.7 below), and provided such access is only given to the extent reasonably required to enable the Customer or its Affiliates to use the mParticle Platform in accordance with this Agreement (each, an “Authorized User”).
2. (b) Restrictions. Except as expressly permitted hereunder, Customer will not, and will not permit or authorize any third party to: (i) reverse engineer, decompile, disassemble or otherwise attempt to discover the source code, object code or underlying structure, ideas or algorithms of any of the mParticle Platform; (ii) modify, translate or create derivative works based on any of the mParticle Platform; (iii) copy (except for archival purposes), rent, lease, distribute, pledge, assign or otherwise transfer or allow any lien, security interest or other encumbrance on any of the mParticle Platform; (iv) use any of the mParticle Platform for timesharing or service bureau purposes or (except as expressly permitted by the mParticle Platform) otherwise for the benefit of a third party; (v) hack, manipulate, interfere with or disrupt the integrity or performance of or otherwise attempt to gain unauthorized access to any of the mParticle Platform or its related systems, hardware or networks or any content or technology incorporated in any of the foregoing; (vi) remove or obscure any proprietary notices or labels of mParticle or its suppliers on any of the mParticle Platform; (vii) access all or any part of the mParticle Platform to build a product or service which competes with the mParticle Platform; (viii) knowingly input, upload or transmit any thing or device (including any software, code, file or program) that may prevent, impair or otherwise adversely affect the operation of any computer software, hardware or network, or adversely affect the user experience through the mParticle Platform or the systems of mParticle, or do anything which may damage, destroy, disrupt, disable, impair, interfere with or otherwise impede or harm the mParticle Platform or the systems of mParticle; or (ix) use the mParticle Platform in a way which infringes or otherwise violates the intellectual property rights of a third party.
3. (c) Requirements. Customer shall use, and shall procure that each Authorized User shall use, the mParticle Platform in accordance with (i) the documentation made available by mParticle to Customer from time to time (the “Documentation”), including the technical documentation available at https://docs.mparticle.com/ (for the mParticle Service and Analytics Service) and https://www.vidora.com/docs/ (for the Cortex Service); (ii) all Applicable Laws; and (iii) the terms of this Agreement.

1.4 Access Credentials and mParticle API Keys. Customer and Customer’s Authorized Users are solely responsible for the confidentiality and use of their username and password (“Access Credentials”) and mParticle API keys (“mParticle API Keys”). Customer shall immediately notify mParticle if any Access Credentials and/or mParticle API Keys have been stolen or compromised. Customer acknowledges and agrees that Customer shall be responsible for all activities and all loss, damage and expense incurred by mParticle that occur under Customer’s and Authorized Users’ Access Credentials and mParticle API Keys, including but not limited to, any misuse, communications, or any data (including Customer Data) entered through such Access Credentials and mParticle API Keys by Customer or permitted by Customer’s failure to keep its Access Credential and mParticle API Keys confidential, unless such loss, damage or expense arising out of the unauthorized use of Access Credentials and/or mParticle API Keys is caused by mParticle’s gross negligence, willful misconduct or breach of this Agreement.

1.5 Service Limitations.

1. (a) Default Service Limits. Customer’s use of the mParticle Platform is subject to the service limitations located at http://docs.mparticle.com/guides/default-service-limits/ (the “Default Service Limits”). The Default Service Limits are provided as an upper bound designed to detect possible errors in data ingestion and damage to the mParticle Platform and is in no way intended to decrease the number of MTUs (as defined below) for which Customer has contracted. If the Default Service Limits are exceeded, mParticle reserves the right to throttle and/or cap Customer’s use of the mParticle Platform.
2. (b) Sensitive Data. Customer will not use the mParticle Platform to collect, transmit, provide, or otherwise make available “sensitive information”, “sensitive data” or “special categories of personal data”, as these terms are defined under Applicable Laws related to data protection and privacy (collectively, “Sensitive Data”) including, but not limited to, personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, government-issued identification numbers, debit, credit card and bank account numbers, genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or a person’s sex life or sexual orientation, or data relating to criminal convictions or offences.

1.6 Privacy; Data Security. Each of the Parties shall comply with the privacy and security obligations set forth in the mParticle Platform Privacy and Security Rider attached hereto as Exhibit A (the “Privacy Rider”).

1.7 Customer Affiliates. For purposes of this Agreement, “Affiliate” means any entity that directly or indirectly controls or is controlled by, or is under common control with, the party specified, where for purposes of this definition, “control” means direct or indirect ownership of more than fifty percent (50%) of the voting interests of the subject entity. An Affiliate of Customer may use the mParticle Platform in accordance with this Agreement on the basis of (a) the Order between Customer and mParticle or (b) a separate Order between mParticle and such Affiliate (and in such case this Agreement shall apply to such Order). Customer shall be liable for the acts and omissions of such Affiliate in connection with this Agreement and such Affiliate’s use of the mParticle Platform. Customer shall ensure that any claim by an Affiliate of Customer hereunder shall only be brought against mParticle by Customer on behalf of such Affiliate.

1.8 mParticle Affiliates. mParticle’s Affiliates may provide the mParticle Platform, or a portion thereof, to Customer in accordance with this Agreement and any applicable Order. mParticle will (a) be responsible for the portions of the mParticle Platform provided by mParticle Affiliates; and (b) not be relieved of its obligations under this Agreement if mParticle’s Affiliates provide the mParticle Platform or a portion thereof.

1.9 Beta and Early Access Services. mParticle may make available to Customer products or services that are (a) identified as beta or similar services (“Beta Services”), or (b) production-ready to deliver value to customers, but which may have known limitations that may impact expected functionality or performance under certain scenarios or use cases (“Early Access Services”), in each case which shall be subject to the terms communicated by mParticle to Customer through email, a document (including an Order or the Documentation) or a website. Customer may, in its sole discretion, choose to use a Beta Service or Early Access Service. Beta Services and Early Access Services are not considered part of the mParticle Platform, mParticle SDK or mParticle API under this Agreement; provided, however, Customer’s obligations set forth in this Agreement in connection with Customer’s access and/or use of mParticle Platform, mParticle SDK and/or mParticle API shall apply equally to the Beta Services and Early Access Services. mParticle offers limited product and customer engineering support and documentation for the Beta Services and Early Access Services. mParticle may discontinue Beta Services and Early Access Services at any time, in mParticle’s sole discretion, and may never make them generally available. In the event of any conflict between this Section 1.9 and an effective separate addendum or other agreement governing the use of the Beta Services or Early Access Services signed by Customer and mParticle, such separate addendum or other agreement shall control.

2. Ownership; Reservation of Rights

2.1 Customer Data. Customer shall own all right, title and interest in and to the data derived or collected by the mParticle SDK incorporated into the Supported Customer Properties, integration via a data warehouse connection and/or any data inputted by Customer into the mParticle Platform (“Customer Data”). Customer hereby grants to mParticle a non-exclusive, worldwide, royalty-free, fully paid up, sublicensable (solely to mParticle’s authorized subcontractors, including mParticle’s sub-processors), right and license during the Term to copy, distribute, display and create derivative works of and use the Customer Data to perform mParticle’s obligations under this Agreement. Customer reserves any and all right, title and interest in and to the Customer Data, other than the license expressly granted to mParticle under this Agreement. Except as expressly permitted hereunder or as authorized by Customer in connection with its use of the mParticle Platform, mParticle will not, and will not authorize any third party to: (a) rent, sublicense, transfer, disclose, use, or grant any rights in, or share or provide access to any Customer Data, in any form, collected and created under this Agreement; or (b) collect, use, combine, aggregate, or commingle the Customer Data for the benefit of any third party.

2.2 mParticle Platform Ownership; Reservation Of Rights. Customer acknowledges and agrees that, as between the Parties, mParticle retains all right, title, and interest in and to the mParticle Platform, all copies or parts thereof (by whomever produced) and all intellectual property rights therein. Customer shall acquire no rights, title, or interest in or to the mParticle Platform or any copies thereof (by whoever produced), other than the limited licensed rights expressly granted by mParticle under this Agreement. Customer will not remove, obscure, or alter any intellectual property rights notices relating to the mParticle Platform.

2.3 mParticle Usage Data. Customer acknowledges that mParticle collects data about its customers’ usage of the mParticle Platform (“mParticle Usage Data”) and uses it for the sole purpose of generating insights about the use of the mParticle Platform to support and improve the mParticle Platform generally. For avoidance of doubt, mParticle Usage Data will not contain any Customer Data collected by Customer and ingested by the mParticle Platform. mParticle may use aggregated mParticle Usage Data that does not identify Customer or any of its users for the purpose of describing its products in marketing materials (e.g., total volume of data processed by the mParticle Platform).

2.4 Feedback. Customer may from time to time provide suggestions, comments for enhancements or functionality or other feedback (“Feedback”) to mParticle with respect to the mParticle Platform. mParticle may determine whether or not to proceed with the development of the requested enhancements, new features or functionality. Customer hereby grants mParticle a royalty-free, fully paid up, worldwide, transferable, sublicensable, irrevocable, perpetual license to (a) copy, distribute, transmit, display, perform, and create derivative works of the Feedback; and (b) use the Feedback and/or any subject matter thereof, including without limitation, the right to develop, manufacture, have manufactured, market, promote, sell, have sold, offer for sale, have offered for sale, import, have imported, rent, provide and/or lease products or services which practice or embody, or are configured for use in practicing, the Feedback and/or any subject matter of the Feedback.

3. FEES; PAYMENT TERMS

3.1 Fees. Customer will pay mParticle all undisputed fees and other amounts due to mParticle under or in connection with this Agreement (“Fees”) at such times as indicated on the Order, as set forth elsewhere in this Agreement or, where no such time period is stipulated in the Order or the Agreement, within thirty (30) days after Customer’s receipt of invoice. Unless otherwise stated in the Order, all Fees are payable in U.S. Dollars. The Fees for access and use of the mParticle Platform are based on annual credits or a base number of MTUs and/or events. Unless otherwise agreed to by the Parties in writing, all Fees shall automatically increase by five percent (5%) for each successive Renewal Term (as defined below). In connection with any Fee increase pursuant to the foregoing provision, at least 10 days prior to the end of the then-current Term, mParticle shall provide a confirmatory Order to Customer showing the Fees for the upcoming Renewal Term.

1. (a) Credit-Based Pricing. If the applicable Order indicates Fees are based on annual credits (to account for a combination of events processed, storage periods and data evaluation), mParticle shall charge Customer Fees based on the pricing set forth therein, subject to payment of additional Fees for Customer’s purchase of additional annual credits and payment of overages, in each case as set forth in such Order.
2. (b) Event/MTU-Based Pricing. If the applicable Order indicates Fees are based on a number of MTUs and/or events, mParticle shall calculate and bill overage fees for the mParticle Platform (“Overage Fees”) monthly in arrears for MTU and/or events usage in excess of this base number of MTUs and/or events (“Monthly Overage”). The Order may specify a single rate for Overage Fees in which case all Monthly Overages will be charged at that rate. Alternatively, the Order may specify tiered pricing. In such event, if Customer’s usage increases and elevates Customer from a lower tier to a higher tier, the pricing for the higher tier shall become the pricing for the remainder of the Term (unless usage increases afterward to an even higher tier). There will be no reversion to lower tiers. For each month in which Customer moves from a lower tier to a higher tier, mParticle shall invoice the Customer for the difference between the Fees for the new tier and the amount already paid for lower tiers, prorated for the remainder of the Term. As used herein, (i) “MTU” means an mParticle ID that has any activity in a calendar month, and (ii) “mParticle ID” means a single user-profile record created for a specified workspace as governed by Customer’s desired identity strategy.

3.2 Late Payment. If payment of any undisputed Fees (including any reimbursement of expenses) is not made when due, without prejudice to any other right or remedy available to mParticle, following written notice by mParticle to Customer, interest shall accrue at a rate equal to the lesser of one and one-half percent (1.5%) per month or the highest legal rate permitted by Applicable Law, and Customer will pay all reasonable expenses of collection. In addition, if any past due payment of Fees has not been received by mParticle within ten (10) days from the time such payment is due, following written notice by mParticle to Customer, mParticle may suspend access to the mParticle Platform until such payment is made in full.

3.3 Net of Taxes. All amounts payable by Customer to mParticle hereunder are exclusive of any sales, use and other taxes or duties, however designated, including without limitation, withholding taxes, royalties, know-how payments, customs, privilege, excise, sales, use, value-added and property taxes (collectively "Taxes"). Customer shall be solely responsible for payment of any Taxes, except for those taxes based on the income of mParticle. Customer will not withhold any Taxes from any amounts due to mParticle, and all amounts payable by Customer under this Agreement shall be paid in full without any set-off, counterclaims or deductions ("Reductions"). If any Reductions are required by Applicable Law, the Customer shall, when making the payment to which the reduction relates, pay to mParticle such additional amount as will ensure that mParticle receives the same total amount that it would have received if no such reduction had been required.

3.4 Reimbursable Expenses. Customer will reimburse mParticle for travel and other related expenses associated with ongoing support, such as Quarterly Business Reviews (QBRs) and on-site visits, provided that Customer approves such activities via email in advance (such approval not to be unreasonably withheld or delayed) and mParticle complies with any applicable Customer travel and expense policy provided to mParticle from time to time.

4. TERM, TERMINATION

4.1 Term. This Agreement shall be effective from the Effective Date and shall, unless terminated earlier in accordance with the terms of this Agreement, continue until the end of the Initial Term (as set forth on the Order). Upon the expiration of the Initial Term, this Agreement shall automatically renew for additional, successive one year terms (each, a “Renewal Term”) unless either Party delivers to the other Party written notice at least sixty (60) days prior to the end of the Initial Term or the applicable Renewal Term of the Party’s intent not to renew this Agreement. If this Agreement is not renewed under this Section 4.1, this Agreement shall terminate automatically upon the expiration of the Initial Term or the applicable Renewal Term (as the case may be). For purposes of this Agreement, “Term” shall mean the Initial Term together with any subsequent Renewal Terms.

4.2 Termination; Effect of Termination. In addition to any other remedies it may have, either Party may terminate this Agreement (a) by written notice to the other Party if there are no Orders in effect; (b) if the other Party breaches any of the terms or conditions of this Agreement in any material respect and such breach is incapable of cure or, where such breach is capable of cure, fails to cure such breach within thirty (30) days’ notice (or ten (10) days in the case of nonpayment by Customer of Fees) after receiving notice thereof; and (c) unless otherwise prohibited by Applicable Law, by written notice to the other Party in the event of the other Party’s liquidation, commencement of dissolution proceedings, or any other proceeding relating to a receivership, failure to continue business, assignment for the benefit of creditors, or becoming the subject of bankruptcy. Subject to Section 4.3, upon any termination or expiration of this Agreement for any reason (and except as expressly provided for otherwise in this Agreement): (i) mParticle shall promptly delete or erase the Customer Data or the encryption key to the Customer Data, provided that Customer may obtain an extract of Customer Data available on the mParticle Platform using mParticle’s standard raw data integration tools set forth in the Documentation and a copy of Customer’s events configuration via the mParticle API; (ii) all rights granted hereunder and all obligations of mParticle to provide the mParticle Platform shall immediately terminate and Customer shall cease use of the mParticle Platform; and (iii) Customer will pay all Fees due and owing.

4.3 Survival. Upon expiration or termination of this Agreement, all obligations in this Agreement shall terminate, provided that any provision of this Agreement that expressly or by implication is intended to come into or continue in force on or after its termination shall remain in full force and effect, including Sections 2.2 (mParticle Platform Ownership), 2.3 (mParticle Usage Data), 2.4 (Feedback), 3 (Fees; Payment Terms), 4.2 (Termination; Effect of Termination), 5 (Confidentiality), 6.3 (Disclaimer), 7 (Limitations of Liability; Indemnification), 10 (General), and this 4.3 (Survival).

5. CONFIDENTIALITY

5.1 Definition of Confidential Information. As used herein, “Confidential Information” means any non-public information or data, regardless of whether it is in tangible form, disclosed by either Party (the “Disclosing Party”) to the other Party (the “Receiving Party”) that the Disclosing Party has either marked as confidential or proprietary, the Disclosing Party has identified in writing as confidential or proprietary within thirty (30) days of disclosure to the Receiving Party, or that a prudent business person in Receiving Party’s position would conclude is confidential given the nature of the information or the circumstances surrounding its disclosure; provided, however, that a Disclosing Party’s business plans, strategies, technology, research and development, current and prospective customers, billing records, and products or services shall be deemed Confidential Information of the Disclosing Party even if not so marked or identified. For the avoidance of doubt, mParticle’s Confidential Information includes, without limitation, the mParticle Platform and the terms of this Agreement and Customer’s Confidential Information includes, without limitation, Customer Data. Notwithstanding the foregoing, “Confidential Information” does not include information that: (a) is known to the Receiving Party prior to receipt from the Disclosing Party directly or indirectly from a source other than one having an obligation of confidentiality to the Disclosing Party; (b) becomes known (independently of disclosure by the Disclosing Party) to the Receiving Party directly or indirectly from a source other than one having an obligation of confidentiality to the Disclosing Party; (c) becomes publicly known or otherwise ceases to be secret or confidential, except through a breach of this Agreement by the Receiving Party; or (d) is independently developed by Receiving Party without use of the Confidential Information of the Disclosing Party.

5.2 Use and Non-disclosure of Confidential Information. Each Party acknowledges that the Confidential Information constitutes valuable trade secrets and proprietary information of a Party, and each Party agrees that it shall use the Confidential Information of the other Party solely in accordance with the provisions of this Agreement and it will not disclose, or permit to be disclosed, the same directly or indirectly, to any third party without the other Party’s prior written consent, except as otherwise permitted hereunder. The Receiving Party will protect the confidentiality of the Disclosing Party’s Confidential Information using the same degree of care that it uses to protect the confidentiality of its own confidential information, but in no event less than reasonable care. Notwithstanding any provision of this Agreement, either Party may disclose Confidential Information, in whole or in part (a) to its employees, officers, directors, professional advisers (e.g., attorneys, auditors, financial advisors, accountants and other professional representatives), existing and prospective investors or acquirers contemplating a potential investment in or acquisition of a Party, sources of debt financing, acquirers and/or subcontractors who have a need to know and are legally bound to keep such Confidential Information confidential by confidentiality obligations or, in the case of professional advisors, are bound by legal duties to keep such Confidential Information confidential consistent with the terms of this Agreement; and (b) as reasonably deemed by a Party to be required by Applicable Law (in which case each Party shall provide the other with prior written notification thereof, shall provide such Party with the opportunity to contest such disclosure, and shall use its reasonable efforts to minimize such disclosure to the extent permitted by Applicable Laws). Each Party shall promptly notify the other in writing if it becomes aware of any violations of the confidentiality obligations set forth in this Agreement.

5.3 Equitable Relief; Return and Destruction of Confidential Information. In the event of actual or threatened breach of the provisions of this Section, the non-breaching Party will be entitled to seek immediate injunctive and other equitable relief, without waiving any other rights or remedies available to it. Upon the termination of this Agreement and except as expressly provided otherwise in this Agreement, the Receiving Party agrees to promptly return to the Disclosing Party or destroy all Confidential Information of the Disclosing Party that is in the possession of the Receiving Party and, if requested by the Disclosing Party, certify the return or destruction of all such Confidential Information and embodiments thereof. Nothing in this Section will require a Receiving Party to return or destroy Confidential Information that is stored in the ordinary course in any electronic archiving or automatic back-up system where the retrieval or destruction of the Confidential Information would require the destruction or deletion of the system; provided that any Confidential Information retained will at all times remain subject to the confidentiality obligations in this Agreement.

6. REPRESENTATIONS, WARRANTIES AND DISCLAIMER

6.1 Mutual Representations and Warranties. Each Party represents and warrants to the other Party that (a) such Party has the required power and authority to enter into this Agreement and to perform its obligations hereunder; (b) the execution of this Agreement and performance of its obligations thereunder do not and will not violate any other agreement to which it is a party; and (c) this Agreement constitutes a legal, valid and binding obligation of such Party when signed by the other Party.

6.2 Uptime. mParticle shall use reasonable efforts consistent with prevailing industry standards to provide the mParticle Platform in a manner that minimizes errors and interruptions in accessing the mParticle Platform. mParticle Platform may be temporarily unavailable for scheduled maintenance or for unscheduled emergency maintenance, either by mParticle or by third-party providers, or because of other causes beyond mParticle’s reasonable control, but mParticle shall use reasonable efforts to provide advance notice in writing or by email of any scheduled service disruption within mParticle’s control.

6.3 Disclaimer. WITHOUT LIMITING MPARTICLE’S EXPRESS WARRANTIES AND OBLIGATIONS HEREUNDER, (A) THE MPARTICLE PLATFORM IS PROVIDED ON AN “AS-IS” BASIS, AND MPARTICLE HEREBY DISCLAIMS ANY AND ALL WARRANTIES OF ANY KIND, WHETHER EXPRESS, IMPLIED (EITHER IN FACT OR BY OPERATION OF LAW), OR STATUTORY, AS TO ANY MATTER WHATSOEVER, INCLUDING, BUT NOT LIMITED TO, ALL IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, QUALITY, ACCURACY, TITLE, AND NON-INFRINGEMENT; AND (B) CUSTOMER ASSUMES SOLE RESPONSIBILITY FOR RESULTS OBTAINED FROM THE RECEIPT AND USE OF, AND FOR CONCLUSIONS OR INFERENCES DRAWN FROM SUCH USE OF, THE MPARTICLE PLATFORM. FOR PURPOSE OF CLARITY, MPARTICLE WILL HAVE NO LIABILITY WHATSOEVER IN CONNECTION WITH ANY SENSITIVE DATA INGESTED INTO THE MPARTICLE PLATFORM OR ANY SECURITY INCIDENT RELATED THERETO. MPARTICLE DOES NOT WARRANT THAT THE MPARTICLE PLATFORM IS ERROR-FREE OR THAT OPERATION THEREOF WILL BE SECURE OR UNINTERRUPTED. NEITHER PARTY WILL HAVE THE RIGHT TO MAKE OR PASS ON ANY REPRESENTATION OR WARRANTY ON BEHALF OF THE OTHER PARTY TO ANY THIRD PARTY. BETA SERVICES AND EARLY ACCESS SERVICES ARE PROVIDED “AS IS, “WHERE IS” AND “AS AVAILABLE” WITH NO WARRANTIES WHATSOEVER, AND MPARTICLE WILL HAVE NO LIABILITY (INCLUDING, BUT NOT LIMITED TO, ANY OBLIGATION TO INDEMNIFY CUSTOMER UNDER THIS AGREEMENT) FOR ANY LOSSES, LIABILITIES AND DAMAGES ARISING OUT OF OR IN CONNECTION WITH THE BETA SERVICES OR EARLY ACCESS SERVICES. CUSTOMER HEREBY ASSUMES AND ACCEPTS ANY AND ALL RISK ASSOCIATED WITH USE OF THE BETA SERVICES AND EARLY ACCESS SERVICES.

7. LIMITATIONS OF LIABILITY; INDEMNIFICATION

7.1 Disclaimer of Consequential Damages. THE PARTIES HERETO AGREE THAT, NOTWITHSTANDING ANY OTHER PROVISION IN THIS AGREEMENT, IN NO EVENT SHALL EITHER PARTY BE LIABLE TO THE OTHER FOR ANY SPECIAL, INDIRECT, RELIANCE, INCIDENTAL OR CONSEQUENTIAL DAMAGES OF ANY KIND, LOST OR DAMAGED DATA, LOST PROFITS OR REVENUE, LOSS OF ANTICIPATED SAVINGS, OR LOSS OF OR DAMAGE TO GOODWILL (COLLECTIVELY, AN “EXCLUDED LOSS”), WHETHER ARISING IN CONTRACT, TORT (INCLUDING NEGLIGENCE), OR OTHERWISE, EVEN IF A PARTY HAS BEEN NOTIFIED OF THE POSSIBILITY THEREOF. THE FOREGOING DISCLAIMER WILL NOT APPLY TO THE EXTENT PROHIBITED BY APPLICABLE LAW. NOTWITHSTANDING THE FOREGOING, THE FOLLOWING WILL NOT BE DEEMED TO BE AN EXCLUDED LOSS FOR PURPOSES OF THIS AGREEMENT: (A) ANY AMOUNTS PAYABLE BY AN INDEMNIFIED PARTY TO A THIRD PARTY PURSUANT TO A JUDGMENT OR TO A SETTLEMENT AGREEMENT APPROVED IN ACCORDANCE WITH SECTION 7.6 (INDEMNIFICATION PROCEDURE) BELOW, LIABILITY FOR WHICH FALLS WITHIN THE INDEMNIFYING PARTY’S INDEMNIFICATION OBLIGATIONS UNDER THIS AGREEMENT; (B) ALL FEES PAYABLE BY CUSTOMER UNDER THIS AGREEMENT; AND (C) CUSTOMER’S BREACH OF SECTION 1 (PROVISION AND USE OF THE MPARTICLE PLATFORM) ABOVE.

7.2 General Cap on Liability. NOTWITHSTANDING ANY OTHER PROVISION OF THIS AGREEMENT, EXCEPT FOR (A) CUSTOMER’S BREACH OF SECTION 1 (PROVISION AND USE OF THE MPARTICLE PLATFORM) ABOVE, AND (B) LIABILITY ARISING FROM A PARTY’S INDEMNIFICATION OBLIGATIONS SET FORTH IN SECTION 7.4 AND SECTION 7.5 BELOW, AS APPLICABLE, UNDER NO CIRCUMSTANCES WILL EITHER PARTY’S AGGREGATE LIABILITY FOR DIRECT DAMAGES ARISING UNDER OR RELATING TO THIS AGREEMENT (INCLUDING BUT NOT LIMITED TO WARRANTY CLAIMS), REGARDLESS OF THE FORUM AND REGARDLESS OF WHETHER ANY ACTION OR CLAIM IS BASED ON CONTRACT, TORT, OR OTHERWISE, EXCEED THE TOTAL FEES PAID BY CUSTOMER TO MPARTICLE UNDER THIS AGREEMENT DURING THE TWELVE (12) MONTH PERIOD PRECEDING THE EVENT OR CIRCUMSTANCES GIVING RISE TO SUCH LIABILITY.

7.3 Independent Allocations of Risk. EACH PROVISION OF THIS AGREEMENT THAT PROVIDES FOR A LIMITATION OF LIABILITY, DISCLAIMER OF WARRANTIES, OR EXCLUSION OF DAMAGES IS TO ALLOCATE THE RISKS OF THIS AGREEMENT BETWEEN THE PARTIES. EACH OF THESE PROVISIONS IS SEVERABLE AND INDEPENDENT OF ALL OTHER PROVISIONS OF THIS AGREEMENT, AND EACH OF THESE PROVISIONS WILL APPLY EVEN IF THEY HAVE FAILED OF THEIR ESSENTIAL PURPOSE.

7.4 Indemnification by mParticle.

1. (a) Indemnity. mParticle shall indemnify, defend and hold harmless (“Indemnify”) Customer and its Affiliates and its and their respective officers, directors and employees (“Customer Indemnified Parties”) from any and all losses, liabilities, penalties, costs and expenses, including reasonable attorneys’ fees (collectively, the “Liabilities”) incurred by the Customer Indemnified Parties in connection with any third-party action, demand, claim, or proceeding (each, a “Claim”) arising from the use of the mParticle Platform in accordance with this Agreement infringing or misappropriating any third-party intellectual property rights (an “Infringement Claim”).
2. (b) Limitations on Infringement Claims. Notwithstanding the foregoing, mParticle shall have no liability or obligation under this Section with respect to any Liability for an Infringement Claim if such Liability is caused in whole or in part by (i) modification of the mParticle Platform by any party other than mParticle without mParticle’s express consent; (ii) the combination, operation, or use of the mParticle Platform with other product(s), data or services where the mParticle Platform would not by itself be infringing; or (iii) unauthorized or improper use of the mParticle Platform. If the use of the mParticle Platform by Customer has become, or in mParticle’s opinion is likely to become, the subject of any Infringement Claim, mParticle may at its option and expense (A) procure for Customer the right to continue using the mParticle Platform as set forth hereunder; (B) replace or modify the mParticle Platform to make it non-infringing so long as the mParticle Platform has at least equivalent functionality; (C) substitute an equivalent for the mParticle Platform; or (D) if options (A)-(C) are not reasonably practicable, terminate this Agreement.
3. (c) Exclusive Liability. This Section 7.4 states mParticle’s entire obligation and Customer’s sole remedies in connection with any Infringement Claim.

7.5 Indemnification by Customer. Customer shall Indemnify mParticle and its Affiliates and its and their respective officers, directors and employees (“mParticle Indemnified Parties”) from Liabilities incurred by the mParticle Indemnified Parties in connection with any Claim arising from or related to: (a) a breach by Customer of Section 1 (Provision and Use of the mParticle Platform); (b) any use by Customer of the mParticle Platform in violation of this Agreement; (c) a breach by Customer of Section 3.3 of the Privacy Rider; or (d) the use by mParticle of Customer Data in accordance with this Agreement.

7.6 Indemnification Procedure. If a Customer Indemnified Party or a mParticle Indemnified Party (each, an “Indemnified Party”) becomes aware of any Claim it believes it should be indemnified under Section 7.4 or Section 7.5, as applicable, the Indemnified Party will give the other Party (the “Indemnifying Party”) prompt written notice of such Claim; provided, however, any failure to give such prompt notice will not relieve the Indemnifying Party of its obligations under this Section 7 except to the extent the Indemnifying Party was actually and materially prejudiced by such failure. The Indemnified Party will cooperate, at the expense of the Indemnifying Party, with the Indemnifying Party and its counsel in the defense and the Indemnified Party will have the right to participate fully, at its own expense, in the defense of such Claim with counsel of its own choosing. Notwithstanding anything to the contrary in this Section 7, the Indemnifying Party will not settle any Claims for which it has an obligation to indemnify pursuant to this Section 7 admitting liability or fault on behalf of the Indemnified Party, or create any obligation on behalf of the Indemnified Party, without the Indemnified Party’s prior written consent, which will not be unreasonably withheld or delayed.

8. PROFESSIONAL SERVICES

mParticle offers its customers use of its customer solutions group for assistance in implementation, training, customization, and other services applicable to Customer’s use of the mParticle Platform (the “Professional Services”). Any Professional Services to be provided by mParticle to Customer will be set forth in a statement of work, a copy of which may be attached hereto or to an Order as an exhibit or separately that references this Agreement and is signed by authorized representatives of the Parties (each, a “Professional Services SOW”). Each Professional Services SOW (a) will describe the Professional Services to be provided by mParticle, the fees to be paid by Customer for such Professional Services, and any other terms and conditions that may be agreed to by the Parties with respect to such Professional Services; and (b) is deemed incorporated into, and made a part of, this Agreement and will be governed by the terms and conditions of this Agreement. To the extent any provision set forth in a Professional Services SOW conflicts with any provision set forth in this Agreement, the provision set forth in this Agreement will take precedence. Unless otherwise expressly provided in a Professional Services SOW, all rights, title, and interest to and in any work product developed pursuant to the Professional Services (including, but not limited to, all copyrights, patents, trademarks, and other intellectual property rights relating thereto) will be owned by mParticle and will be deemed to be included in the definition of mParticle Platform licensed to Customer on the terms set forth herein; provided, however, the term “work product” will not be deemed to include any Customer Confidential Information or Customer Data provided by or on behalf of Customer to mParticle for inclusion or incorporation into such work product, all of which shall remain the sole and exclusive property of Customer.

9. PROOF OF CONCEPT ENGAGEMENT

This Section 9 shall apply to any proof of concept engagement or demo of the mParticle Platform by Customer (a “POC”). mParticle will make an account available to Customer for the purposes of use case testing in connection with the POC. Any POC to be provided by mParticle to Customer will be set forth in a statement of work or similar document, a copy of which may be attached hereto as an exhibit or separately that references this Agreement and is signed by authorized representatives of the Parties (each, a “POC SOW”). Each POC SOW will describe the POC to be provided by mParticle to Customer (including testing parameters and clearly defined, mutually agreed-upon measures of success) and any other terms and conditions that may be agreed to by the Parties with respect to such POC. Each POC SOW is deemed incorporated into, and made a part of, this Agreement and will be governed by the terms and conditions of this Agreement, except for the following provisions hereof: (a) Section 4.1 with respect to the Renewal Term will not apply to the POC; (b) any service level agreements between Customer and mParticle for the mParticle Platform will not apply to the POC; and (c) the general cap on mParticle’s liability in Section 7.2 shall be US$1,000.00. To the extent any provision set forth in a POC SOW conflicts with any provision set forth in this Agreement, the provision set forth in this Agreement will take precedence. Unless otherwise expressly provided in a POC SOW, all rights, title, and interest to and in any work product developed pursuant to the POC (including, but not limited to, all copyrights, patents, trademarks, and other intellectual property rights relating thereto) will be owned by mParticle and will be deemed to be included in the definition of mParticle Platform and licensed to Customer on the terms set forth herein; provided, however, the term “work product” will not be deemed to include any Customer Confidential Information or Customer Data provided by or on behalf of Customer to mParticle for inclusion or incorporation into such work product, all of which shall remain the sole and exclusive property of Customer. The Initial Term for the POC may be extended by mutual written agreement of the Parties. If Customer desires to subscribe to the mParticle Platform following the completion of the POC, the Parties shall execute and deliver an Order referencing this Agreement.

10. GENERAL

10.1 Severability. If any provision of this Agreement is found to be unenforceable or invalid, that provision will be limited or eliminated to the minimum extent necessary so that this Agreement will otherwise remain in full force and effect and enforceable.

10.2 Assignment. Neither Party may assign this Agreement or assign or delegate its rights or obligations under the Agreement without the other Party’s prior written consent; provided however, that either Party may assign this Agreement to an acquirer of or successor to all or substantially all of its business or assets to which this Agreement relates, whether by merger, sale of assets, sale of stock, reorganization or otherwise. Any assignment or attempted assignment by either Party other than in accordance with this Section 10.2 shall be null and void.

10.3 Third Party Beneficiaries. This Agreement does not confer any benefits on any third party unless it expressly states that it does.

10.4 Entire Agreement. The Parties agree that this Agreement is the complete and exclusive statement of the mutual understanding of the Parties and supersedes all previous written and oral agreements, communications and other understandings relating to the subject matter of this Agreement.

10.5 Waiver; Amendment. The waiver by a Party of any term, provision or of a Party’s breach of this Agreement will not be effective unless such waiver is in writing and signed by the Party against whom such waiver is asserted. No waiver by a Party of a breach of this Agreement by the other Party will constitute a waiver of any other or subsequent breach by such other Party, and no failure or delay by either Party in exercising any right, power or privilege under this Agreement will operate as a waiver of it. This Agreement may be modified only by mutual written agreement of authorized representatives of the Parties.

10.6 Relationship of the Parties. No agency, partnership, joint venture, or employment is created as a result of this Agreement and a Party does not have any authority of any kind to bind the other Party in any respect whatsoever.

10.7 Injunctive Relief. Customer acknowledges that any unauthorized use of the mParticle Platform will cause irreparable harm and injury to mParticle for which there is no adequate remedy at law. In addition to all other remedies available under this Agreement, at law or in equity, Customer further agrees that mParticle shall be entitled to injunctive relief in the event Customer uses the mParticle Platform in violation of the limited license granted herein or uses the mParticle Platform in any way not expressly permitted by this Agreement.

10.8 Cumulative Rights. The rights and remedies expressly conferred by the Agreement are cumulative and additional to any other rights or remedies a Party may have.

10.9 Notices. mParticle will provide all notices to Customer under this Agreement by pre-paid first class mail, air courier or e-mail to the mailing or e-mail address Customer provided to mParticle on the applicable Order, or during Customer’s registration for the mParticle Platform, or to a substitute, updated mailing or e-mail address that Customer has provided to mParticle for these purposes. Customer is responsible for keeping its mailing and e-mail address current with mParticle. Except as otherwise specified in this Agreement, all notices to be given to mParticle under this Agreement must be in writing and sent by email to legal@mparticle.com, or by prepaid first class mail or air courier at the address specified on the first page of this Agreement, or to a substitute, updated address notified by mParticle, marked “Attention: Legal Department.” Notices will be deemed to have been duly given when received, if personally delivered; when receipt is electronically confirmed, if transmitted by email; the day after it is sent, if sent for next day delivery by recognized overnight delivery service; and upon receipt, if sent by certified or registered mail, return receipt requested. The foregoing notice provisions do not apply to the service of any proceedings or any documents in any legal action related to this Agreement.

10.10 Publicity. Each Party agrees that it will not, without prior written consent of the other, issue a press release regarding their business relationship. Notwithstanding the foregoing, mParticle may (a) create demonstration and marketing materials and information which includes Customer Data solely in anonymized or aggregated format and disclose and otherwise make such materials and information available solely in connection with marketing and demonstrating the mParticle Platform; and (b) mention Customer and the relationship between mParticle and Customer in mParticle’s marketing collateral, website, and other promotional and marketing materials.

10.11 Force Majeure. Each Party shall be excused from performance for any period during which, and to the extent that, it is prevented from performing any obligation or service, in whole or in part, as a result of a cause beyond its reasonable control and without its fault or negligence (other than Customer’s obligation to pay Fees), including, but not limited to, acts of God, acts of war, epidemics, fire, communication line failures, power failures, earthquakes, floods, blizzard, or other natural disasters (but excluding failure caused by a Party's financial condition or any internal labor problems (including strikes, lockouts, work stoppages or slowdowns, or the threat thereof)) (a “Force Majeure Event”). Upon the occurrence of any Force Majeure Event, the affected Party shall give the other Party written notice thereof as soon as reasonably practicable of its failure of performance, describing the cause and effect of such failure, and the anticipated duration of its inability to perform. Delays in performing obligations due to a Force Majeure Event shall automatically extend the deadline for performing such obligations for a period equal to the duration of such Force Majeure Event; provided, however, the Party affected by a Force Majeure Event will take all reasonable actions to minimize the consequences and cause the cessation of any such event. Except as otherwise agreed upon by the Parties in writing, in the event such non-performance due to a Force Majeure Event continues for a period of thirty (30) days or more, either Party may terminate this Agreement by giving written notice thereof to the other Party.

10.12 Governing Law; Jurisdiction. This Agreement shall be governed by the laws of the State of New York, U.S.A., without regard to its conflict of laws provisions. For all disputes relating to this Agreement, each Party submits to the exclusive jurisdiction of the state and federal courts located in the Borough of Manhattan in the City of New York, New York, U.S.A, and waives any jurisdictional, venue, or inconvenient forum objections to such courts. The United Nations Convention on Contracts for the International Sale of Goods shall not apply. In any action or proceeding to enforce rights under this Agreement, the prevailing Party will be entitled to recover costs and attorneys’ fees.

10.13 Counterparts. This Agreement may be executed in multiple counterparts, each of which will be deemed an original, but all of which together will constitute one and the same instrument. Counterparts may be delivered via electronic mail (including .pdf or electronic signature) or other transmission method and any counterpart so delivered will be deemed to have been duly and validly delivered and be valid and effective for all purposes.

10.14 Interpretation. The terms “including”, “include”, “in particular”, “for example” or any similar expression shall be construed as illustrative and shall not limit the sense of the words, description, definition, phrase or term preceding those terms. A reference to a statute or statutory provision shall be a reference to it as amended, extended or re-enacted from time to time, and shall also include all subordinate legislation made from time to time under that statute or statutory provision. Any reference to the requirement for something to be given, received or similar in “writing” or “written” shall include and permit this to be done by e-mail provided such e-mail is sent to an authorized representative of that Party. Unless the context requires otherwise, words importing the singular number include the plural and vice versa; words importing gender include all genders. The headings used in this Agreement and its division into sections, schedules, exhibits, appendices, and other subdivisions do not affect its interpretation. The Parties have each participated in the drafting and negotiation of this Agreement. Accordingly, any rule of legal interpretation to the effect that any ambiguity is to be resolved against the drafting party will not apply in interpreting this Agreement.

EXHIBIT A

MPARTICLE PLATFORM PRIVACY AND SECURITY RIDER

This mParticle Platform Privacy and Security Rider (this “Rider”) is incorporated into and made a part of the mParticle Platform Services Agreement to which this Rider is attached (the “Agreement”) and will be effective on the effective date of the Agreement. Any capitalized term used but not defined in this Rider will have the meaning ascribed to it in the Agreement and any sections referenced herein shall refer to sections of this Rider unless otherwise indicated. For the purposes of this Rider only, and except where otherwise indicated, references to "Customer" shall include Customer and its Affiliates authorized to use the mParticle Platform pursuant to Section 1.7 of the Agreement.

The Parties agree as follows:

1. Definitions

1. "Controller" means an entity that alone or jointly with others determines the purposes and means of Processing of Personal Data. For purposes of this Rider, a Controller includes a “business” as such term is defined by the CCPA or a similar or analogous designation under Data Protection Laws.
2. "Customer Personal Data" means any Customer Data that is protected as "personal data", "personal information" or "personally identifiable information" under Data Protection Laws that mParticle Processes on behalf of Customer under the Agreement, as more particularly described in Annex I of this Rider.
3. “Data Privacy Framework” or "DPF" means the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. Data Privacy Framework, and the Swiss-U.S. Data Privacy Framework self-certification programs operated by the U.S. Department of Commerce, and their respective successors, as applicable.
4. “DPF Principles” means the Principles and Supplemental Principles contained in the relevant DPF; as amended, superseded or replaced from time to time.
5. "Data Protection Laws" means, to the extent applicable, European Data Protection Laws and the CCPA, as may be amended, superseded or replaced.
6. "Europe" means, for the purposes of this Rider, the European Economic Area and/or its member states, the United Kingdom ("UK") and Switzerland.
7. "European Data Protection Laws" means (a) Regulation 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) ("GDPR"); (b) Directive 2002/58/EC concerning the processing of personal data and the protection of privacy in the electronic communications sector; (c) in respect of the United Kingdom, the GDPR as saved into United Kingdom law by virtue of Section 3 of the United Kingdom's European Union (Withdrawal) Act 2018 (the "UK GDPR"), the Data Protection Act 2018, the Privacy and Electronic Communications (EC Directive) Regulations 2003 as they continue to have effect by virtue of section 2 of the European Union (Withdrawal) Act 2018, and any other applicable laws in force in the UK (in whole or in part) to the processing of personal data (together, "UK Data Protection Laws"); (d) the Swiss Federal Act on Data Protection of 2020 and its Ordinance ("Swiss FADP"); and (e) any and all applicable national data protection laws made under, pursuant to or that apply in conjunction with any of (a), (b), (c) and (d) above; in each case as may be amended, superseded or replaced from time to time.
8. “Process,” “Processes,” “Processing,” “Processed” means any operation or set of operations which is performed on data or sets of data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination, or otherwise making available, alignment or combination, restriction, erasure, or destruction.
9. "Processor" means an entity that Processes Customer Personal Data on behalf, and in accordance with the instructions, of a Controller. For purposes of this Rider, a Processor includes a "service provider" as such term is defined by the CCPA or any similar or analogous designation under Data Protection Laws.
10. "Restricted Transfer" means a transfer (directly or via onward transfer) of Customer Personal Data that is subject to European Data Protection Laws to a country outside Europe which is not subject to an adequacy determination by the European Commission, UK or Swiss authorities (as applicable).
11. "Security Incident" means any breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Customer Personal Data transmitted, stored or otherwise Processed by mParticle under this Rider. A "Security Incident" will not include unsuccessful attempts or activities that do not compromise the security of Customer Personal Data, including unsuccessful login attempts, pings, port scans, denial of service attacks, and other network attacks on firewalls or networked systems.
12. "Standard Contractual Clauses" or "SCCs" means the standard contractual clauses for the transfer of Customer Personal Data to third countries annexed to the European Commission's Implementing Decision 2021/914 of 4 June 2021 located at https://commission.europa.eu/publications/standard-contractual-clauses-international-transfers_en, as updated or amended from time to time.
13. "Sub-processor" means any third party that has access to Customer Personal Data and is engaged by mParticle to assist in fulfilling its obligations with respect to providing the mParticle Platform under the Agreement. The term “Sub-processor” may include mParticle Affiliates, but shall exclude mParticle employees, contractors and consultants.
14. "UK Addendum" means the International Data Transfer Addendum to the Standard Contractual Clauses (version B1.0) "UK Addendum to the EU Standard Contractual Clauses" issued by the Information Commissioner's Office under s.119A(1) of the UK Data Protection Act 2018, as it is revised under Section 18 therein; as may be amended, superseded or replaced from time to time.
15. "US Privacy Laws" means all privacy laws and regulations of the United States in force and effect, including but not limited to (i) the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA"); (ii) the Virginia Consumer Data Protection Act; (iii) the Colorado Privacy Act; (iv) the Utah Consumer Privacy Act; (v) the Connecticut Data Privacy Act; and (vi) any and all binding regulations promulgated thereunder, pursuant to or that apply in conjunction with any of (i), (ii), (iii), (iv) and (v) above; in each case as may be amended, superseded or replaced from time to time.

2. Scope of this Rider

1. This Rider applies where and only to the extent mParticle Processes Customer Personal Data under the Agreement as a Processor acting on behalf of Customer.
2. Any Processing of Customer Personal Data under the Agreement shall be performed in accordance with Data Protection Laws. However, mParticle is not responsible for compliance with any Data Protection Laws applicable to Customer or Customer's industry that are not applicable to mParticle.
3. Customer acknowledges that mParticle shall have a right to process Customer Personal Data for the purposes of creating anonymized, aggregated and/or de-identified information for its own legitimate business purposes.

3. Processing of Customer Personal Data

1. Permitted Purposes. mParticle shall Process Customer Personal Data in accordance with Customer's documented lawful instructions, except where required by Data Protection Laws. For these purposes, Customer instructs mParticle to Process Customer Personal Data for the following purposes: (a) to perform any steps necessary for the performance of the Agreement; (b) to provide, maintain and improve the mParticle Platform in accordance with the Agreement including, but not limited to, the collection or use by mParticle of mParticle Usage Data; (c) Processing initiated by end users in their use of the mParticle Platform; (d) to comply with other reasonable instructions provided by Customer (e.g., via email or support tickets) that are consistent with the terms of the Agreement (including this Rider); and (e) to comply with mParticle's legal obligations under Applicable Law, including Data Protection Laws (collectively and individually the "Permitted Purposes").
2. Processing Instructions. The Parties agree that the Agreement (including this Rider), and Customer's use of the mParticle Platform in accordance with the Agreement, set out Customer's complete and final Processing instructions and (if applicable) include and are consistent with all instructions from third party controllers. Any Processing outside the scope of these instructions (if any) shall require prior written agreement between Customer and mParticle. Customer shall ensure its instructions are lawful and that the Processing of Customer Personal Data in accordance with such instructions will not violate Data Protection Laws.
3. Customer Responsibilities. Where applicable, Customer shall be responsible for any communications, notifications, assistance and/or authorizations that mParticle may be required to provide to or receive from a third party controller. Customer is responsible for the accuracy, quality and lawfulness of Customer Personal Data Processing under or in connection with the Agreement and for determining whether the mParticle Platform is appropriate for the storage and Processing of Customer Personal Data under Data Protection Laws. Customer further agrees that: (a) it will comply with its obligations under Data Protection Laws regarding its use of the mParticle Platform and the Processing of Customer Personal Data; (b) it has provided, and will continue to provide, all notice and obtained, and will continue to obtain, all consents, permissions and rights necessary for mParticle and its Sub-processors to lawfully Process Customer Personal Data for the purposes contemplated by the Agreement (including this Rider); and (c) it will notify mParticle if it is unable to comply with its obligations under Data Protection Laws or its Processing instructions will cause mParticle or its Sub-processors to be in breach of Data Protection Laws.

4. Sub-processors

1. Customer provides a general authorization to mParticle to engage Sub-processors to Process Customer Personal Data on Customer's behalf as a Processor. Customer specifically authorizes the engagement of those Sub-processors listed at https://docs.mparticle.com/guides/approved-subcontractors/, or such other successor URL(s) notified to Customer from time to time ("Sub-processor Lists"). mParticle will restrict Sub-processors' access to Customer Personal Data to what is necessary to assist mParticle in performing the Permitted Purposes and will remain responsible for any acts or omissions of Sub-processors to the extent they cause mParticle to breach its obligations under this Rider.
2. Sub-processor Obligations. mParticle shall enter into a written agreement with each Sub-processor imposing data protection obligations no less protective of Customer Personal Data as required by this Rider (to the extent applicable, considering the nature of the services provided by the Sub-processor).
3. Changes to Sub-processors. mParticle will provide at least thirty (30) days' prior notice via updating the Sub-processor Lists (or such other notification mechanism made available by mParticle) if it intends to make any changes to its Sub-processors. Customer may object in writing to mParticle's appointment of a new Sub-processor on reasonable grounds relating to data protection (e.g., if making Customer Personal Data available to the Sub-processor would violate European Data Protection Laws or weaken the protections for Customer Personal Data) by notifying mParticle in writing to legal@mparticle.com within ten (10) days of receiving notification from mParticle. In such event, the Parties shall discuss Customer's concerns in good faith with a view to achieving a mutually acceptable resolution. If the Parties cannot reach a mutually acceptable resolution, mParticle shall, at its sole discretion, either not appoint the Sub-processor, or permit Customer to suspend or terminate the affected portion of the mParticle Platform in accordance with the Agreement without liability to either Party (but without prejudice to any fees incurred by Customer prior to suspension or termination).

5. Security

1. Security Measures. mParticle shall implement and maintain appropriate technical and organizational security measures designed to protect Customer Personal Data from Security Incidents and preserve the security and confidentiality of Customer Personal Data, in accordance with the measures described in Annex II ("Security Measures"). Customer acknowledges that the Security Measures are subject to technical progress and development and that mParticle may update or modify the Security Measures from time to time, provided that such updates and modifications do not degrade or diminish the overall security of the mParticle Platform.
2. Access and Confidentiality. mParticle restricts its personnel from Processing Customer Personal Data without authorization and shall ensure that any person who is authorized by mParticle to Process Customer Personal Data is under an appropriate obligation of confidentiality (whether a contractual or statutory duty).
3. Customer Responsibilities. Notwithstanding the above, Customer is responsible for reviewing the information made available by mParticle relating to data security and making an independent determination as to whether the mParticle Platform meets Customer’s requirements and legal obligations under Data Protection Laws. Customer further agrees that Customer is responsible for its secure use of the mParticle Platform, including securing its account authentication credentials and taking any appropriate steps to backup any Customer Personal Data Processed in connection with the mParticle Platform.
4. Security Incidents. Upon becoming aware of a Security Incident, mParticle shall notify Customer without undue delay and, where feasible, within 72 hours. mParticle shall provide Customer with timely information relating to the Security Incident as it becomes known or is reasonably requested by Customer to fulfill its obligations under Data Protection Laws. mParticle will also take reasonable steps to contain, investigate, and mitigate any Security Incident. mParticle's notification of or response to a Security Incident in accordance with this section will not be construed as an acknowledgment by mParticle of any fault or liability with respect to the Security Incident.

6. Audits

1. mParticle shall provide Customer (on a confidential basis) written responses (which may include audit report summaries/extracts) to all reasonable requests made by Customer for information relating to mParticle's Processing of Customer Personal Data, including responses to information and security audit questionnaires submitted to it by Customer and that are necessary to confirm mParticle's compliance with this Rider, provided that Customer will not exercise this right more than once per calendar year or when Customer is expressly requested or required to provide this information to a supervisory authority, or mParticle has experienced a Security Incident, or on another reasonably similar basis. Nothing herein shall be construed to require mParticle to provide: (a) trade secrets or any proprietary information; (b) any information that would violate mParticle's confidentiality obligations, contractual obligations, or Applicable Law; or (c) any information, the disclosure of which could threaten, compromise, or otherwise put at risk the security, confidentiality, or integrity of mParticle's infrastructure, networks, systems, or data.

7. International Transfers

1. Customer acknowledges and agrees that mParticle and its Affiliates and Sub-processors may transfer and Process Customer Personal Data to and in the United States and the other locations in which mParticle, its Affiliates or its Sub-processors maintain data processing operations as more particularly described in the Sub-Processor Lists. mParticle shall ensure that such transfers are made in compliance with Data Protection Laws and this Rider. If mParticle engages in a Restricted Transfer, such measures may include (without limitation) transferring the Customer Personal Data to a recipient that: (i) is covered by a suitable framework or other legally adequate transfer mechanism recognized by the relevant authorities or courts as providing an adequate level of protection, including the DPF; (ii) has achieved binding corporate rules authorization; or (iii) has executed SCCs; in each case as adopted or approved in accordance with Data Protection Laws.
2. If the Order for the mParticle Service with Customer indicates that Customer Data will be localized in Europe or Australia, Customer Data will be stored and Processed in Europe or Australia (as applicable) solely in connection with Customer’s use of the mParticle Service; provided, however, that if mParticle customer service or technical personnel needs to access Customer Data to perform its obligations to Customer, such personnel may be physically located outside Europe or Australia (as applicable) and therefore technically a small amount of data may be Processed outside Europe or Australia, as applicable, and, as such, the Parties hereby enter into Standard Contractual Clauses to account for such transfers. For purpose of clarity, this Section 7.2 will not apply to the Analytics Service or Cortex Service.

8. Deletion or Return of Customer Personal Data

1. Upon termination or expiry of the Agreement, at Customer's written request, mParticle shall delete or return all Customer Personal Data in its possession or control in accordance with the terms of the Agreement. This requirement shall not apply to the extent mParticle or its Affiliates or Sub-processors are required by Applicable Law to retain some or all of the Customer Personal Data, or to Customer Personal Data archived on back-up systems, which shall be securely isolated and protected from any further Processing (to the extent permitted by Applicable Law). The Parties agree that the certification of deletion of Customer Personal Data described in Clause 8.5 and 16 (d) of the SCCs shall be provided by mParticle to Customer only upon Customer's written request.

9. Cooperation

1. Data subject requests. To the extent that Customer is unable to independently access the relevant Customer Personal Data within the mParticle Platform, mParticle shall, taking into account the nature of the Processing, provide reasonable cooperation to assist Customer in responding to any requests from individuals relating to the Processing of Customer Personal Data under the Agreement. In the event that any such request is made to mParticle directly, mParticle shall promptly notify Customer and will not respond to the request directly except to direct the data subject to the Customer without Customer's prior authorization, unless and to the extent legally compelled to do so.
2. Law enforcement requests. If a law enforcement agency sends mParticle a demand for Customer Personal Data (including through a subpoena or court order), mParticle will attempt to redirect the law enforcement agency to request that Customer Personal Data directly from Customer. As part of this effort, mParticle may provide Customer’s basic contact information to the law enforcement agency. If compelled to disclose Customer Personal Data to a law enforcement agency, then mParticle will give Customer reasonable notice of the demand to allow Customer to seek a protective order or other appropriate remedy, unless mParticle is legally prohibited from doing so.
3. Data Protection Impact Assessment and Prior Consultation. mParticle agrees to provide reasonable assistance to Customer where the type of Processing performed by mParticle requires a data protection impact assessment, risk assessment, cybersecurity audit or similar under Data Protection Laws and/or queries, inquiry, complaint or prior consultation with any regulatory, supervisory, governmental, state agency, Attorney General or other competent authority with jurisdiction or oversight over compliance with Data Protection Laws.
4. General cooperation. Each Party will reasonably cooperate with the other in any activities contemplated by this Rider and to enable each Party to comply with its respective obligations under Data Protection Laws.

10. Jurisdiction Specific Terms

United States.

1. This Section shall apply to the extent that Customer Personal Data is subject to US Privacy Laws, in addition to the terms in the remainder of this Rider. In the event of any conflict or ambiguity between the terms in this Section 10.1 and any other terms in this Rider, the terms in this Section 10.1 shall take precedence but only to the extent they apply to the Customer Personal Data in question.
2. mParticle is a service provider under the CCPA and receives Customer Personal Data pursuant to and solely for the business purpose of providing the mParticle Platform to Customer in accordance with the Agreement (including this Rider).
3. mParticle shall not, unless otherwise permitted by US Privacy Laws, (a) retain, use or disclose Customer Personal Data for any purpose other than the Permitted Purposes, including to retain, use or disclose Customer Personal Data for a commercial purpose other than performing the mParticle Platform under the Agreement; (b) "sell" or "share" Customer Personal Data (as defined and interpreted within the requirements of US Privacy Laws); and (c) retain, use, or disclose the Customer Personal Data outside the direct business relationship between the Parties. mParticle will comply with any applicable restrictions under the CCPA or other US Privacy Laws on combining Customer Personal Data received from Customer with personal information that mParticle receives from, or on behalf of, another person or persons, or that mParticle collects from any interaction between it and an individual. The Parties agree that Customer's transfer of Customer Personal Data to mParticle is not a "sale" (as defined and interpreted under US Privacy Laws), and Customer provides no monetary or other valuable consideration to mParticle in exchange for the Customer Personal Data.
4. As applicable under US Privacy Laws, mParticle acknowledges Customer’s right to take reasonable and appropriate steps to stop and remediate any unauthorized use of Customer Personal Data by mParticle.

Europe.

1. To the extent that Customer Personal Data is subject to European Data Protection Laws, the terms in this Section 10.2 shall apply in addition to the terms in the remainder of this Rider. In the event of any conflict or ambiguity between the terms in this Section 10.2 and any other terms in this Rider, the terms in this Section 10.2 shall take precedence but only to the extent they apply to the Customer Personal Data in question.
2. Processing Instructions. Without prejudice to Section 3.3 (Customer Responsibilities), mParticle shall notify Customer in writing, unless prohibited from doing so under Data Protection Laws, if it becomes aware or believes that any Processing instructions from Customer violate European Data Protection Laws.
3. Restricted Transfers. The Parties agree as follows when the transfer of Customer Personal Data from Customer (as "data exporter") to mParticle (as "data importer") is a Restricted Transfer:
4. Data Privacy Framework: mParticle shall rely on the DPF to lawfully receive Customer Personal Data in the United States and mParticle shall ensure that it provides at least the same level of protection to such Customer Personal Data as is required by the DPF Principles.
5. Standard Contractual Clauses: If the DPF does not cover the Restricted Transfer and/or the DPF is invalidated or cannot be relied upon for any other reason, the SCCs shall automatically be deemed incorporated into and form a part of this Rider, as follows:
6. in relation to Customer Personal Data protected by the GDPR, the SCCs shall apply completed as follows:
7. Module Two (Controller to Processor) or Module Three (Processor to Processor) will apply, as appropriate;
8. in Clause 7, the optional docking clause will not apply;
9. in Clause 9, Option 2 will apply, and the time period for prior notice of Sub-processor changes shall be as set out in Section 4.3;
10. in Clause 11, the optional language will not apply;
11. in Clause 17, Option 1 will apply, and the SCCs will be governed by the laws of Ireland;
12. in Clause 18(b), disputes shall be resolved before the courts of the EU Member State selected above;
13. Annex I of the SCCs shall be deemed completed with the information set out in Annex I to this Rider; and
14. Subject to Section 5.1, Annex II of the SCCs shall be deemed completed with the information set out in Annex II to this Rider;
15. in relation to Customer Personal Data protected by UK Data Protection Laws, the SCCs as implemented under sub-paragraph (a) above will apply with the following modifications:
16. the SCCs shall be deemed amended as specified by Part 2 of the UK Addendum;
17. tables 1 to 3 in Part 1 of the UK Addendum shall be deemed completed respectively with the information set out in Annexes I and II and Section 4.1 of this Rider (as applicable); and
18. table 4 in Part 1 of the UK Addendum shall be deemed completed by selecting "neither party".
19. in relation to Customer Personal Data protected by the Swiss FADP, the SCCs will also apply in accordance with sub-paragraph (a) above with the following modifications:
20. references to "Regulation (EU) 2016/679" shall be interpreted as references to the Swiss FADP;
21. references to specific Articles of "Regulation (EU) 2016/679" shall be replaced with the equivalent article or section of the Swiss FADP;
22. references to "EU", "Union", "Member State" and "Member State law" shall be replaced with references to "Switzerland" or "Swiss law";
23. the term "member state" shall not be interpreted in such a way as to exclude data subjects in Switzerland from the possibility of suing for their rights in their place of habitual residence (i.e., Switzerland);
24. Clause 13(a) and Part C of Annex I are not used and the "competent supervisory authority" is the Swiss Federal Data Protection Information Commissioner;
25. references to the "competent supervisory authority" and "competent courts" shall be replaced with references to the "Swiss Federal Data Protection Information Commissioner" and "applicable courts of Switzerland";
26. in Clause 17, the Standard Contractual Clauses shall be governed by the laws of Switzerland;
27. Clause 18(b) shall state that disputes shall be resolved before the applicable courts of Switzerland; and
28. the SCCs shall also protect the data of legal entities until the entry into force of the revised Swiss Federal Data Protection Act.
29. It is not the intention of either Party to contradict or restrict any of the provisions set forth in the Standard Contractual Clauses and, accordingly, if and to the extent the SCCs conflict with any provision of the Agreement (including this Rider) the SCCs shall prevail to the extent of such conflict.
30. Alternative Transfer Arrangements. To the extent mParticle adopts an alternative lawful data export mechanism for the transfer of Customer Personal Data not described in this Rider ("Alternative Transfer Mechanism"), the Alternative Transfer Mechanism shall, upon notice to Customer, apply instead of any applicable transfer mechanism described in this Rider (but only to the extent such Alternative Transfer Mechanism complies with European Data Protection Laws and extends to the territories to which Customer Personal Data is transferred) and Customer agrees to execute such other and further documents and take such other and further actions as may be reasonably necessary to give legal effect such Alternative Transfer Mechanism.

11. Limitation of Liability

1. Any claim or remedy Customer or its Affiliates may have against mParticle and its Affiliates and their respective employees, agents and Sub-processors, arising under or in connection with this Rider (including the Standard Contractual Clauses), whether in contract, tort (including negligence) or under any other theory of liability, shall be subject to the limitations and exclusions of liability in the Agreement. Accordingly, any reference in the Agreement to the liability of a Party means the aggregate liability of that Party and all of its Affiliates under and in connection with the Agreement and this Rider together.
2. mParticle will have no liability whatsoever in connection with any Sensitive Data ingested into the mParticle Platform by Customer contrary to the provisions in the Agreement and this Rider.
3. For the avoidance of doubt, Customer Affiliates shall be entitled to exercise their rights and remedies available under this Rider to the extent the Agreement applies and where required under Data Protection Laws. However, if Data Protection Laws require the Affiliate to directly exercise a right or remedy against mParticle directly by itself, the Parties agree that to the extent permitted under applicable law: (i) only the Customer that is the contracting entity to the Agreement shall exercise any such right or seek any such remedy on behalf of the Affiliate; and (ii) the Customer that is the contracting party to the Agreement shall exercise any such rights under this Rider in a combined manner for all of its Affiliates together, instead of doing so separately for each Affiliate. The Customer that is the contracting entity is responsible for coordinating all communication with mParticle under this Rider and shall be entitled to make and receive any communication related to this Rider on behalf of its Affiliates.

12. Miscellaneous

1. Each Party acknowledges that the other Party may disclose this Rider (including the Standard Contractual Clauses) and any relevant privacy provisions in the Agreement to the U.S. Department of Commerce, the Federal Trade Commission, a European data protection authority or any other U.S. or European judicial or regulatory body upon their request.
2. In the event of a conflict between the Agreement and this Rider, this Rider shall take precedence with respect to any terms as they relate to mParticle's Processing of any Customer Personal Data.
3. Notwithstanding anything else to the contrary in the Agreement and without prejudice to Section 3.2, mParticle may periodically make modifications to this Rider as may be required to comply with Data Protection Laws.
4. The provisions of this Rider are severable. If any phrase, clause or provision or Annex (including the Standard Contractual Clauses) is invalid or unenforceable in whole or in part, such invalidity or unenforceability shall affect only such phrase, clause or provision, and the rest of this Rider or the remainder of the Agreement, which shall remain in full force and effect.
5. This Rider shall be governed by and construed in accordance with the governing law and jurisdiction provisions in the Agreement, unless required otherwise by Data Protection Laws or the SCCs or UK Addendum.

ANNEX I

A. LIST OF PARTIES

Data exporter:

• Name of the data exporter: The entity identified as the “Customer” in the Agreement and Rider.
• Address: The address for the Customer associated with its mParticle account or otherwise specified in the Agreement.
• Contact person’s name, position and contact details: The contact details associated with Customer's account, or otherwise specified in this Rider or the Agreement.
• Activities relevant to the data transferred: The activities specified in Annex I(B) below.
• Role (Controller/Processor): Controller.
• Signature and date: This Annex I shall automatically be deemed executed when the Agreement is executed by Customer.

Data importer:

• Name of the data importer: The entity identified as mParticle in the Agreement and Rider.
• Address: The address specified in the Agreement.
• Contact person’s name, position and contact details: Legal Department, legal@mparticle.com.
• Activities relevant to the data transferred: The activities specified in Annex I(B) below.
• Role (Controller/Processor): Processor.
• Signature and date: This Annex I shall automatically be deemed executed when the Agreement is executed by mParticle.

B. DESCRIPTION OF THE PROCESSING / TRANSFER

Categories of data subjects whose personal data is transferred

Past, present, or future employees, agents, or representatives of the data exporter, its customers, the past, present, or future employees, agents, or representatives of its customers, and other data subjects whose data may be provided pursuant to the Agreement.

Categories of personal data transferred

Personal data may include names, email addresses and pseudonymous personal data such as IP Addresses and mobile advertising ID collected from the mobile applications and other digital property owned or controlled by Customer.

Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures

N/A. Customer will not use the mParticle Platform to collect, transmit or provide sensitive data, or otherwise make available sensitive data to the mParticle Platform.

Frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis)

Personal Data may be transferred on a continuous or one-off basis depending on the Customer's use of the mParticle Platform and the Customer's processing instructions.

Nature of the processing

The provision of the mParticle Platform as described in the Agreement and initiated by the Customer from time to time.

Purpose(s) of the data transfer and further processing

The Permitted Purposes (as defined in the Rider).

The period for which the Personal Data will be retained or, if that is not possible, the criteria used to determinate that period

The duration of the Agreement plus the period from the expiry of the Agreement until deletion of the Personal Data by mParticle in accordance with this Rider.

For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing

In line with the information provided in this Annex I.B.

C. COMPETENT SUPERVISORY AUTHORITY

The data exporter's competent supervisory authority will be determined in accordance with European Data Protection Laws.

ANNEX II

TECHNICAL AND ORGANISATIONAL MEASURES INCLUDING TECHNICAL AND ORGANISATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA

Description of the technical and organisational security measures implemented by the data importer in accordance with Clauses 4(d) and 5(c):

As a cloud-native company, the mParticle Platform makes extensive use of the Amazon AWS platform and the wide range of security features that AWS provides. AWS uses a ‘Shared Responsibility Model’, where Amazon is responsible for securing the underlying infrastructure and networks and the mParticle Platform secures the data that is hosted and code that runs in the environment.

All mParticle Platform systems use TLS, where supported, to protect data in transit between end user devices, the mParticle Platform and its partner services. Data is also encrypted at rest within the AWS environment using AES256 to encrypt mParticle’s EBS Volumes. mParticle Platform production secrets are protected using an identity-based secrets / encryption management system with role-based access configured. The mParticle Platform makes use of Cloud Native Application Protection Platform to identify and report on known vulnerabilities in production hosts.

All mParticle personnel engaged with the mParticle Platform undergo background checks and annual security training and must adhere to published internal security policies. Policy areas include:

• Password strength and complexity
• Encryption and key management
• Device tooling and Monitoring
• Secure development practices
• Secrets Management
• Disciplinary actions

mParticle enforces strict role-based access control with periodic audits to all mParticle Platform systems (corporate and production) and operate using the principle of least privilege. mParticle’s personnel engaged with the mParticle Platform are only given the access that they require to do their job. By default, no such mParticle personnel are able to access Customer Personal Data as it is both physically and logically separated from mParticle’s corporate network. Developers are not granted access to the production infrastructure and all deploys are performed by processes managed by the mParticle operations team.

mParticle engages a number of third-party penetration testing companies to provide assessments of the mParticle Platform’s security stance, at least once per year. These tests include, but are not limited to, web application and infrastructure engagements.

mParticle’s dedicated security team makes use of monitoring and logging capabilities from all areas of the mParticle Platform stack to identify malicious behavior with automated alerting in place to flag anomalies.

Only authorised devices are able to connect to mParticle’s corporate networks and all devices are forced to include the following protections:

• Antivirus with automatic daily updates
• DNS protection using DNS filtering technology to protect against malicious sites
• Full disk encryption. Every device is configured to use strong encryption to protect local data.
• Endpoint protection/management tools - mParticle has tooling on every corporate system to ensure compliance and detect malicious behaviour.
• Automatic password protected screensaver locks
• Automatic account lockouts on number of authentication attempts

mParticle utilises Okta for centralised authentication and supplement with multi factor authentication for access to sensitive mParticle Platform systems including mParticle’s VPNs, AWS and production environments. For 2FA, mParticle makes use of MFA technology, including device trust, physical yubikeys, smart cards and software-based tokens to limit access to individual hosts within production in combination with SSH keys via locked down bastion hosts.

mParticle conducts security audits of any third party vendors and sub-contractors engaged by mParticle in connection with the mParticle Platform, and expects at least a comparable level of security from such vendors and sub-contractors.

Supplemental Measures implemented pursuant to The European Data Protection Board (EDPB) Recommendations 01/2020 on measures which supplement mParticle Platform transfer tools to ensure compliance with the EU level of protection of personal data Version 2.0 and adopted on 18 June 2021 are available upon request.

A Transfer Impact Assessment for the mParticle Platform and any additional supplemental measures implemented in connection therewith, as applicable, are available upon request.