Data Processing Addendum

This is a translation of the Dutch version. In case of discrepancy, the Dutch version prevails.

This Data Processing Addendum (including its appendices, the “Addendum”) forms part of the Underlying Agreement (as defined below) between Integer Technologies B.V. and the Customer.

This Addendum applies where Integer Technologies B.V. (the "Processor") processes Personal Data on behalf of the Customer (the "Controller") in connection with the Underlying Agreement.

General Terms

Overview

This Addendum describes the parties’ obligations, including under applicable privacy, data security, and data protection laws, with respect to the processing and security of personal data. This Addendum will be effective on the Addendum Effective Date (as defined below), and will replace any terms previously applicable to the processing and security of Personal Data, including any previous version of this Addendum. Capitalized terms used but not defined in this Addendum have the meaning given to them in the Underlying Agreement.

Considerations

1. A.The Processor performs certain activities on behalf of the Controller that result in the Processor processing personal data on behalf of the Controller. These activities are set forth in a separate agreement (hereinafter: the Underlying Agreement).
2. B.The Controller and the Processor wish to set forth in this Data Processing Addendum the mutual rights and obligations regarding this processing of personal data by the Processor in accordance with the General Data Protection Regulation (“GDPR”).
3. C.This Data Processing Addendum is limited to those aspects of the activities to be performed by the Processor that fall under the GDPR, and has been entered into to fulfill the obligations under Article 28 of the GDPR. Other aspects of the activities to be performed by the Processor, such as requirements set forth in other legislation, licensing aspects of software used or installed, commercial aspects such as payments and costs, etc., are not part of this Data Processing Addendum and are governed by other agreements.

1. Definitions

The words or phrases used in this agreement that are capitalized have the following meanings:

• Addendum: this data processing addendum;
• Addendum Effective Date: date on which parties agreed to this Addendum;
• Underlying Agreement: the agreement describing the work to be performed by the Processor, including the terms and conditions applicable thereto;
• Personal Data: any data relating to an identified or identifiable natural person that is processed by the Processor in connection with the Underlying Agreement; regardless of whether the Processor is authorized to process such data;
• Access Data: usernames, passwords, and other data that grant the Processor access to the Controller’s IT systems;
• Board: the body of supervisory authorities in the European Union as referred to in Chapter VII, Section 2 of the GDPR, and known as the “European Data Protection Board” (EDPB);

Terms not defined in this Addendum shall have the meanings defined in Article 4 of the GDPR.

2. Responsibilities

With regard to the obligations arising from the processing of Personal Data and the GDPR, the following applies:

2.1 The Controller is the controller of the processing of Personal Data within the meaning of Article 4(7) of the GDPR.

2.2 The Processor is a contractor of the Controller and, for the processing of Personal Data, is a processor within the meaning of Article 4(8) of the GDPR.

2.3 Where the Controller uses the Processor's services on behalf of a third party, such as its own client, the Controller is responsible for ensuring that the necessary agreements with that third party are in place, including a data processing agreement where required, and that the third party has authorised the engagement of the Processor and the subprocessors listed in Appendix 2. In that case, the Controller passes on the third party's instructions to the Processor and forwards notifications under Articles 4.10 and 4.12 to the third party where required.

3. Applicability and Scope of Processing

3.1 Unless the Parties have agreed otherwise in writing, the provisions of this Addendum apply to any processing of Personal Data by the Processor.

3.2 The scope of the processing of Personal Data by the Processor follows from the obligations of the Processor as defined in this Addendum, including the annexes.

3.3 The Controller grants the Processor the right to use Personal Data processed under this Addendum to create anonymised and/or aggregated data, which can no longer be related to an identified or identifiable natural person, and to use such anonymised and/or aggregated data to develop, maintain and improve its products and services. The following conditions apply:

1. a.For creating the anonymised and/or aggregated data, the Processor acts as a Controller within the meaning of Article 4(7) of the GDPR and complies with all associated legal requirements, including but not limited to the obligations imposed by Article 6(4) of the GDPR.
2. b.The anonymised and/or aggregated data are not Personal Data. The Processor shall not attempt to re-identify any natural person from such data.
3. c.The Processor shall not use Personal Data for any other purposes of its own.

4. Obligations of the Processor

4.1 The Processor shall process the Personal Data solely on behalf of the Controller, subject to any contrary legal obligations and subject to the provisions of Article 3.3 of this Addendum. The Processor shall inform the Controller in advance of such deviating legal provisions, unless this is prohibited by law.

4.2 The Processor processes data on behalf of the Controller, in accordance with the Controller’s instructions and under the Controller’s responsibility. Details regarding the work to be performed, the categories of Personal Data to be processed, and the categories of data subjects are set forth in Appendix 4, which forms an integral part of this Addendum.

4.3 If, in the Processor’s reasonable judgment, Personal Data must be processed by the Processor for purposes not covered by Article 4.2, the Processor shall immediately notify the Controller. The Processor shall only carry out such processing after obtaining the Controller’s consent. This consent may be given in writing or by email.

4.4 The Processor shall ensure compliance with the conditions imposed on the processing of Personal Data under the GDPR and other applicable laws and regulations. This includes instructing the Processor’s personnel regarding the proper processing of Personal Data in accordance with all applicable laws and regulations. This also includes the obligation for the Processor, its personnel, and all subcontractors, including their personnel, to maintain the confidentiality of the Personal Data. The Processor shall ensure that compliance with this obligation is demonstrable and documented.

4.5 The Processor shall assist the Controller to the best of its knowledge and ability in all aspects of compliance with the requirements of the GDPR for which the Processor’s cooperation or information is required. This includes, but is not limited to, making available the documentation required by the Controller to comply with Article 5(2) of the GDPR. Should the documentation required for this purpose, or any part thereof, contain confidential information or know-how of the Processor, the Processor shall have the right to require that access to the confidential documentation be granted only subject to a written confidentiality agreement. This confidentiality agreement shall in any case include a liability provision in favor of the Processor in the event of a breach of the confidentiality obligation.

4.6 The Parties agree that the obligations arising from Section 4.5 are limited to those aspects of compliance with the GDPR that are directly or indirectly related to the activities to be performed by the Processor under this Addendum and/or the Underlying Agreement.

4.7 The Processor shall exercise the utmost care when processing the Personal Data. The Processor shall at all times ensure that the integrity and accuracy of the Personal Data processed by it is and remains guaranteed.

4.8 The Processor shall not disclose or make Personal Data available to any third party. This prohibition does not apply if the Personal Data is disclosed to a third party:

1. a.pursuant to an explicit written instruction from the Controller, or
2. b.pursuant to a legal requirement, or
3. c.by order of a judicial or administrative authority, provided that in such a case the Processor notifies the Controller within 24 hours of receiving such an order, thereby enabling the Controller to pursue any legal remedy available to it, or
4. d.pursuant to Article 4.14.

Personal data may be disclosed to third parties outside the European Union and the European Economic Area, provided that the Processor ensures a proper legal basis as referred to in Chapter 5 of the GDPR.

4.9 If the Processor is required by law to disclose Personal Data to a competent authority, it shall, unless prohibited by law, notify the Controller in writing before the disclosure and provide all relevant information the Controller reasonably needs to pursue any available legal remedy. The Processor shall disclose no more Personal Data than it is legally required to.

4.10 The Processor is aware of and accepts that it has a reporting obligation, which must be fulfilled as follows:

1. a.The Processor must notify the Controller of any breach involving Personal Data as referred to in Article 33(1) of the GDPR without undue delay, and in any event within 48 hours of discovering it. This timeframe also applies during weekends, vacations and holidays.
2. b.The Processor must provide the Controller with all necessary information and cooperation to enable the Controller to determine as soon as possible the cause and scope of the loss, unauthorized access, breach, or security issue, and to make the required notifications to the competent authorities.
3. c.Where not all information is available within 48 hours, the Processor provides the information it has and supplies the remaining information in phases, as soon as it becomes available.

4.11 A report of an incident as described above in 4.10 may be made by telephone, email, or in writing. A telephone report must be followed up with a report by email or in writing. A report by email must be followed up with a telephone or written report.

4.12 The Processor must immediately notify the Controller of all requests received directly from a data subject that relate to the exercise of data subjects’ rights as defined in the GDPR. The Processor will only comply with such a request if the Controller has instructed the Processor to do so in writing. The Processor shall assist the Controller with appropriate technical and organizational measures in the execution of such a request.

4.13 The Processor shall handle all requests and instructions from the Controller regarding the processing of Personal Data promptly and properly.

4.14 By this Addendum, the Controller authorizes the Processor to engage third parties as subcontractors (subprocessors) for the processing of Personal Data, subject to the following conditions:

1. a.Before the Processor engages a third party as a subprocessor, the Processor shall notify the Controller of its intention to do so and shall grant the Controller a period of 14 days to raise a reasoned objection. This notification may be made in writing or by email.
2. b.If the Controller has not raised a reasoned objection within this period, consent shall be deemed to have been granted.
3. c.If the Controller raises a substantiated objection to the proposed subprocessor, the Controller and the Processor shall, in good faith, seek a solution that addresses the Controller’s objections and enables the Processor to continue to fulfill its obligations under this Addendum and the Underlying Agreement without incurring unreasonable costs or other disadvantages.
4. d.The Processor shall ensure that all subprocessors are bound to comply with all obligations imposed on the Processor under this Addendum. This shall be set forth in writing in the agreement or agreements between the Processor and the subprocessor or subprocessors. The Processor shall provide this agreement or provide the Controller with these agreements upon the Controller’s first request. If any deficiencies are found in these agreements, the Controller has the right to require the Processor to correct such deficiencies or to terminate the collaboration with the relevant subprocessor(s).
5. e.A list of subprocessors for whom consent was granted upon signing the Underlying Agreement is included in Appendix 2. The Processor shall ensure that this list is updated from time to time to reflect the current situation.

4.15 The Processor shall ensure that its personnel are bound to comply with the obligations imposed on the Processor under this Addendum. The Processor shall document this in writing.

4.16 The Processor shall assist the Controller to the best of its ability in fulfilling the Controller’s obligations under Articles 32 through 36 of the GDPR.

4.17 The Processor shall immediately inform the Controller if, in its opinion, an instruction of the Controller infringes the GDPR or other applicable data protection provisions.

5. Security Measures and Inspection

5.1 The Processor shall take all necessary technical and organizational measures to protect the Personal Data against loss and any form of unlawful processing.

5.2 The measures to be taken by the Processor must in any case meet the following requirements:

1. a.Article 32 of the GDPR;
2. b.Applicable mandatory legal requirements established by the Board regarding the nature of the personal data to be processed by the Processor and the nature of such processing;
3. c.Applicable mandatory guidelines of the Board;
4. d.Applicable mandatory specific regulations of the Dutch Data Protection Authority (AP) regarding the nature of the personal data to be processed by the Processor and the nature of such processing;
5. e.Applicable mandatory guidelines of the AP and Appendix 1.

In the event of any conflict between these standards and regulations, the order in which they are listed above shall apply, with the first-mentioned document taking precedence. Compliance with the aforementioned standards and regulations includes, but is not limited to, the audit and inspection obligations contained therein.

5.3 The Processor agrees that, at the request of the Controller, the Processor’s data processing facilities may be inspected in connection with the processing activities covered by this Addendum (“the Inspection”). The Inspection shall be conducted by an investigative body designated by the Controller, which, in the reasonable opinion of the Parties, is independent and competent. The Controller shall ensure that the investigative body is bound by confidentiality regarding its findings vis-à-vis third parties.

5.4 The Inspection covers all obligations arising from this Addendum, the GDPR, and any subordinate laws and regulations based thereon. This includes, but is not limited to, the security measures required under Section 5.2.

5.5 The Processor shall cooperate fully with the investigative body, including by providing access to all documentation necessary to demonstrate compliance with legal obligations and this Addendum. If this documentation or any part thereof contains confidential information or know-how of the Processor, the Processor shall have the right to require that access to the confidential documentation be granted only subject to a written confidentiality agreement. The Controller shall enter into the necessary written agreements with the investigative body for this purpose and make these agreements available to the Processor. These agreements shall in any case include a liability provision in favor of the Processor in the event of a breach of the confidentiality obligation.

5.6 If, in the reasonable opinion of the Processor, an instruction from the Controller or the investigative body, given in connection with the Inspection, is in violation of applicable legal requirements, the Processor shall notify the Controller thereof without delay. Such notification may be made in writing or by email.

5.7 The Controller shall pay all costs, fees, and expenses related to the Inspection, including reasonable internal costs incurred by the Processor. This obligation shall lapse if the Inspection reveals that the Processor fails to comply with or neglects essential obligations under the GDPR and/or this Addendum; this includes, but is not limited to, all obligations of the Processor pursuant to Articles 4.8, 4.10, 4.14, 5.1, and 5.2 of this Addendum. In that case, all costs incurred by the investigative body shall be borne by the Processor.

5.8 The Controller shall provide the Processor with a copy of the Inspection report.

6. Obligations of the Controller

6.1 The Controller shall handle all requests made by a data subject to exercise the rights of data subjects as defined in the GDPR. The Controller shall inform and instruct the Processor in a timely manner regarding all activities to be performed by the Processor in response to such requests.

6.2 The Controller must immediately notify the Processor of any security breaches involving Personal Data that the Controller detects or becomes aware of. The Controller acknowledges and agrees that if this obligation is not fulfilled, the Controller shall be jointly liable with the Processor for any resulting damage to data subjects, pursuant to Article 82 of the GDPR. The Controller’s failure to comply with this obligation does not affect the Processor’s obligations under this Addendum and does not affect the Processor’s liability under Article 7.

6.3 The Controller is responsible for its own compliance with Articles 32 through 36 of the GDPR, including, but not limited to, the obligation to ensure adequate security of its IT systems. This security must comply with current technical standards.

6.4 The Controller shall assist the Processor to the best of its knowledge and ability in all aspects of compliance with the requirements of the GDPR that require the Controller’s cooperation or information.

6.5 The Controller guarantees that the personal data to be processed has been lawfully obtained and is being lawfully processed. The Controller is liable for all damages arising from unlawful acquisition or processing. The Controller indemnifies the Processor against all claims, disputes, losses, damages, and costs incurred by the Processor that directly or indirectly result from or are related to a breach of this obligation.

7. Liability

7.1 Each Party shall be responsible for its own compliance with applicable data protection laws, including the GDPR.

7.2 Each Party shall be liable for damages arising from its own breach of this Addendum or applicable data protection laws.

7.3 Where both Parties are responsible for the same damage, liability shall be allocated between the Parties in accordance with their respective responsibility for the damage, taking into account Article 82 GDPR.

7.4 The Processor shall remain responsible for the performance of its subprocessors’ obligations under this Addendum to the extent required by Article 28(4) GDPR.

7.5 Except where prohibited by applicable law, liability under this Addendum shall be subject to the exclusions and limitations of liability set out in the Underlying Agreement.

7.6 Nothing in this Addendum shall exclude or limit either Party’s liability where such exclusion or limitation is prohibited by applicable law.

8. Termination

8.1 The Addendum is entered into for an indefinite period.

8.2 The Addendum automatically terminates upon the cessation of the Processor’s services. The Addendum may not be terminated in any other manner, unless it is replaced by another Data Processing Addendum covering the entire processing of Personal Data by the Processor.

8.3 The Parties shall review this Addendum and, if necessary, amend it in the event of a significant change in the services provided by the Processor or a relevant change in applicable laws and regulations. The Processor shall notify the Controller of amendments to this Addendum at least 30 days before they take effect, by email to the address referred to in Appendix 3. Changes to Appendix 2 follow Article 4.14.

8.4 Unless otherwise instructed in writing by the Controller and subject to the provisions of Article 3.3 of this Addendum, in the event of termination of the Addendum, the Processor shall:

1. a.Return all Personal Data and Access Data to the Controller,
2. b.Destroy all copies of the Personal Data and Access Data in its possession, and
3. c.Notify the Controller that this destruction has been carried out.

8.5 If, in the Processor’s reasonable judgment, an independent legal obligation of the Processor prohibits or restricts the Processor from returning or destroying the Personal Data in whole or in part, the following shall apply:

1. a.The Processor shall notify the Controller in writing as soon as possible of this legal obligation and the Personal Data covered by it. The Processor shall provide all relevant information that the Controller reasonably needs to determine whether destruction can take place and, if so, under what conditions.
2. b.If, in the reasonable judgment of the Controller, the legal obligation permits the destruction or partial destruction of the Personal Data by the Processor, the Processor shall proceed to do so immediately upon the Controller’s request.
3. c.If the Controller determines that destruction may not take place, it shall notify the Processor thereof in writing. In that case, the Processor guarantees the confidentiality of the Personal Data vis-à-vis the Controller and shall not process the Personal Data except to comply with its aforementioned legal obligation or upon written instruction from the Controller.

8.6 Obligations which by their nature are intended to remain in force after termination of this Addendum, including the confidentiality obligations in Article 4.4, the obligations in Articles 8.4 and 8.5 and the provisions of Article 7, shall remain in force after termination.

9. Severability

If one or more provisions of this Addendum prove to be invalid, the remainder of the Addendum shall remain in force. The parties shall consult regarding the provisions that are not legally valid in order to agree on a replacement provision that is legally valid and that, as far as possible, reflects the intent of the provision to be replaced.

10. Order of Precedence

In the event of a conflict between this Addendum and other agreements relating to the Processor’s services, including but not limited to the Underlying Agreement, this Addendum shall prevail.

11. Notices

Where this Addendum requires a Party to provide the other Party with a notice or notification, the contact details set forth in Appendix 3 shall be used. Any change to these contact details must be communicated to the other Party in writing.

12. Governing Law, Disputes

12.1 Dutch law shall govern this Addendum.

12.2 All disputes arising out of or in connection with this Addendum shall be submitted exclusively to the competent court in the district where the Processor is located.

Appendix 1: Organizational and Technical Measures

The Processor maintains appropriate technical and organizational measures, including access control, multi-factor authentication, encryption in transit, logging, role-based access management, backup and restore procedures, and incident response procedures. These measures are described in more detail in the Processor's Security Policy, a copy of which is provided to the Controller on request, subject to confidentiality.

Appendix 2: Subprocessors

The Controller grants permission under Article 4.14 to engage the following subprocessors:

Appendix 3: Contact Information

All notifications and other communications to the Processor should be addressed to

Integer Technologies B.V., attn. Privacy Officer
Markestrijp 50
5707 DL Helmond, Netherlands
info@integer.energy

All notifications and other communications to the Controller shall be addressed to the email address associated with the Controller’s account or provided in the Underlying Agreement.

Appendix 4: Processing Activities, Categories of Personal Data, Categories of Data Subjects

Appendix 4.1 The Processing of Personal Data Concerns

The processing concerns the provision of the Integer Platform and the Integer Box to the Controller. It involves a limited volume of personal data: contact and identity details of users of the Platform and, exceptionally, building and installation data insofar as these can be related to an identifiable natural person (see Appendix 4.3).

The processing consists of the following operations: collection and storage, access and consultation, modification, analysis, aggregation and anonymisation (see Article 3.3), communication, and deletion.

Appendix 4.2 Duration of the Processing

Platform users

Personal data is retained for the duration of the active user account.

Upon termination of the agreement with the employer of the user, or upon deactivation of the user account, personal data will be deleted or anonymized within 6 months, unless longer retention is necessary:

• to comply with a legal obligation; or
• for the establishment, exercise, or defense of legal claims.

Building and installation data

Building and installation data is retained for the duration of the Underlying Agreement. Upon termination, it is returned or deleted in accordance with Article 8.4, unless it has been anonymised in accordance with Article 3.3.

Appendix 4.3 Categories of Personal Data

Platform users

• Name
• Work email address
• Phone number (Work)
• Job position
• Employer (Company name)
• IP address (Technical log for access security)

Building and installation data

Measurements, setpoints and operating states, such as temperature, CO₂ concentration, occupancy indicators and energy consumption. The Integer services are intended for non-residential buildings and for the shared installations of residential buildings, and process these data at the level of zones or shared installations, not individual dwellings. Building and installation data therefore do not, as a rule, constitute Personal Data. Insofar as they can nevertheless be related to an identifiable natural person in a specific situation (for example, a zone used by one person), this Addendum applies to those data.

Appendix 4.4 Categories of Data Subjects

• Platform Users
• Occupants of the buildings where the Integer Box is installed, only in the situation described in Appendix 4.3

Appendix 4.5 Categories of the Processor's Staff with Access to the Personal Data

Management, administrative staff, business developers and technical staff