DATA PROCESSING ADDENDUM

·DATA PROCESSING ADDENDUM

·This Data Processing Addendum, including its Annexes and the Standard Contractual Clauses ("DPA"), forms an integral part of the Databricks Master Cloud Services Agreement, or any other written agreement that governs Customer's use of the Databricks Services (as defined below) entered into between the entity identified as the "Customer" in the signature block below ("Customer") and Databricks, Inc. ("Databricks") (the "Agreement"), and applies solely to the extent that Databricks processes any Customer Personal Data (defined below) in connection with the Databricks Services. By signing this DPA, Customer enters into this DPA on behalf of itself and, if applicable and to the extent required under Applicable Data Protection Laws, in the name and on behalf of its Authorized Affiliates. All capitalized terms not defined herein shall have the meaning set forth in the Agreement. For the purposes of the DPA only, and except where otherwise indicated, the term "Customer" shall include Customer and its Authorized Affiliates.

11. DEFINITIONS

• 1.11.1. "Applicable Data Protection Laws" means all data protection and privacy laws and regulations applicable to the respective party in its role in the processing of Customer Personal Data under the Agreement, which may include, to the extent applicable, European Data Protection Laws and the CCPA.
• 1.21.2. "Authorized Affiliate" means a Customer Affiliate who is authorized to use the Databricks Services under the Agreement and who has not signed their own separate "Agreement" with Databricks.
• 1.31.3. "CCPA" means the California Consumer Privacy Act of 2018 (Cal. Civ. Code § 1798.100, et seq.), as may be amended, superseded or replaced from time to time.
• 1.41.4. "Customer Content" means, if not defined within the Agreement, all data processed by Databricks on your behalf in the course of providing the Databricks Services.
• 1.51.5. "Customer Personal Data" means any 'personal data' or 'personal information' contained within Customer Content.
• 1.61.6. "Databricks Services" means the Platform Services (as defined in the Agreement) and/or any other services provided directly by Databricks to Customer under the Agreement.
• 1.71.7. "European Data Protection Laws" means (a) Regulation 2016/679 (General Data Protection Regulation) ("EU GDPR"); (b) the EU GDPR as saved into United Kingdom law by virtue of section 3 of the European Union (Withdrawal) Act 2018 ("UK GDPR"); and (c) the Swiss Federal Data Protection Act and its implementing regulations ("Swiss Data Protection Act"); in each case as may be amended, superseded or replaced from time to time.
• 1.81.8. "Restricted Transfer" means a transfer (directly or via onward transfer) of personal data that is subject to European Data Protection Laws to a third country outside the European Economic Area, United Kingdom and Switzerland which is not subject to an adequacy determination by the European Commission, United Kingdom or Swiss authorities (as applicable).
• 1.91.9. "Security Addendum" means the security addendum found at databricks.com/legal/security-addendum.
• 1.101.10. "Security Breach" means a breach of security leading to an accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data.
• 1.111.11. "Standard Contractual Clauses" or "SCCs" means the standard contractual clauses annexed to the European Commission's Implementing Decision 2021/914 of 4 June 2021, as may be amended, superseded or replaced from time to time.
• 1.121.12. "Subprocessor" means any other processor engaged by Databricks to process Customer Personal Data.
• 1.131.13. "UK Addendum" means the International Data Transfer Addendum (version B1.0) issued by the Information Commissioners Office under S.119 (a) of the UK Data Protection Act 2018, as updated or amended from time to time.
• 1.141.14. The terms "controller", "data subject", "supervisory authority", "processor", "process", "processing", "personal data", and "personal information" shall have the meanings given to them in Applicable Data Protection Laws. The term "controller" includes "business", the term "data subject" includes "consumers", and the term "processor" includes "service provider" (in each case, as defined by the CCPA).

22. PROCESSING OF PERSONAL DATA

• 2.12.1. Scope and Roles of the Parties. This DPA applies when Customer Personal Data is processed by Databricks as a processor in its provision of the Databricks Services to Customer, who will act as either a controller or processor, as applicable, of Customer Personal Data.
• 2.22.2. Customer Processing. Customer agrees that (i) it will comply with its obligations under Applicable Data Protection Laws in its processing of Customer Personal Data and any processing instructions it issues to Databricks, and (ii) it has provided notice and obtained (or will obtain) all consents and rights necessary under

·Applicable Data Protection Laws for Databricks to process Customer Personal Data and provide the Databricks Services pursuant to the Agreement (including this DPA).

• 2.32.3. Databricks Processing. Databricks agrees that (a) when Databricks processes Customer Personal Data in its capacity as a processor on behalf of the Customer, Databricks will (i) comply with Applicable Data Protection Laws, and (ii) process the Customer Personal Data as necessary to perform its obligations under the Agreement, and only in accordance with Customer's documented instructions (as set forth in the Agreement, in this DPA, or as directed by the Customer or Customer's Authorized Users through the Databricks Services). Databricks is not responsible for determining if Customer's processing instructions are compliant with applicable law. However, Databricks shall notify Customer in writing if, in its reasonable opinion, the Customer's processing instructions infringe Applicable Data Protection Laws and provided that Customer acknowledges that Customer Personal Data may be processed on an automated basis in accordance with Customers' use of the Databricks Services, which Databricks does not monitor.
• 2.42.4. Details of Processing. The details of the processing of Customer Personal Data by Databricks are set out in Annex A to the DPA.

33. CONFIDENTIALITY

• 3.13.1. Personnel. Databricks shall ensure that any employees or personnel it authorizes to process Customer Personal Data is subject to an appropriate duty of confidentiality.

44. SUBPROCESSING

• 4.14.1. Authorization. Customer provides a general authorization to Databricks use of Subprocessors to process Customer Personal Data in accordance with this Section, including those Subprocessors listed at www.databricks.com/subprocessors ("Subprocessor List").
• 4.24.2. Subprocessor Obligations. Databricks shall (i) enter into a written agreement with its Subprocessors, which includes data protection and security measures no less protective than the measures set forth in this DPA; and (ii) remain fully liable for any breach of the Agreement and this DPA that is caused by an act, error or omission of its Subprocessors to the extent that Databricks would have been liable for such act, error or omission had it been caused by Databricks.
• 4.34.3. Subprocessor Changes. At least thirty (30) calendar days prior to the date on which any new Subprocessor shall commence processing Customer Personal Data, Databricks shall update the Subprocessor List and provide Customer with notice of that update. Such notice will be sent to individuals who have signed up to receive updates to the Subprocessor List via the mechanism(s) indicated on the Subprocessor List.
• 4.44.4. Subprocessor Objections. Customer may object to Databricks' appointment of a new Subprocessor on reasonable grounds relating to data protection by notifying Databricks in writing at privacy@databricks.com within ten (10) calendar days after receiving notice pursuant to Section 4.3. In such an event, Databricks and Customer will discuss those objections in good faith with a view to achieving resolution. If the parties are not able to achieve resolution, within ten (10) calendar days from Databricks' written notification, Customer, as its sole and exclusive remedy, may terminate the Order Form(s) with respect to only those aspects which cannot be provided by Databricks without the use of the new Subprocessor. Databricks will provide Customer with a pro rata reimbursement of any prepaid, but unused fees of such Order Form(s) following the effective date of such termination.

55. ASSISTANCE

• 5.15.1. Data Subject Requests. Customer is responsible for responding to and complying with data subject requests ("DSR"). The Databricks Services include controls that Customer may use to assist it to respond to DSR. If Customer is unable to access or delete any Customer Personal Data using such controls, Databricks shall, taking into account the nature of the processing, reasonably cooperate with Customer to enable Customer to respond to the DSR. If a data subject sends a DSR to Databricks directly and where Customer is identified or identifiable from the request, Databricks will promptly forward such DSR to Customer and Databricks shall not, unless legally compelled to do so, respond directly to the data subject except to refer them to the Customer to allow Customer to respond as appropriate.
• 5.25.2. Data Protection Impact Assessments. Databricks will provide reasonably requested information regarding the Databricks Services to Customer to carry out data protection impact assessments relating to the processing of Customer Personal Data and any related required consultation with supervisory authorities as required by Applicable Data Protection Laws, so long as Customer does not otherwise have access to the relevant information.
• 5.35.3. Legal Requests. If Databricks receives a subpoena, court order, warrant or other legal demand from law enforcement or any public or judicial authority seeking the disclosure of Customer Personal Data, Databricks will attempt to redirect the governmental body to request such Customer Personal Data directly from Customer. As part of this effort, Databricks may provide Customer's basic contact information to the governmental body. If compelled to disclose Customer Personal Data to a governmental body, Databricks will give Customer

·reasonable notice of the legal demand to allow Customer to seek a protective order or other appropriate remedy, unless Databricks is legally prohibited from doing so.

66. SECURITY

• 6.16.1. Security Measures. Databricks has implemented and will maintain appropriate technical and organizational security measures as set forth in the Security Addendum ("Security Measures"). The Security Measures are subject to technical progress and development and Databricks may update the Security Measures, provided that any updates shall not materially diminish the overall security of Customer Personal Data or the Databricks Services. Databricks may make available certain security controls within the Databricks Services that Customer may use in accordance with the Documentation.
• 6.26.2. Security Breach Notification. In the event of a Security Breach, Databricks will (a) notify Customer in writing without undue delay and in no event later than seventy-two (72) hours after becoming aware of the Security Breach; and (b) promptly take reasonable steps to contain, investigate, and mitigate any adverse effects resulting from the Security Breach. Databricks will reasonably cooperate with and assist Customer with respect to any required notification to supervisory authorities or data subjects (as applicable), taking into account the nature of the processing, the information available to Databricks, and any restrictions on disclosing the information (such as confidentiality).

77. AUDITS AND RECORDS

• 7.17.1. Audit Program. Upon written request and at no additional cost to Customer, Databricks shall provide Customer, and/or its appropriately qualified third-party representative, access to reasonably requested documentation evidencing Databricks compliance with its obligations under this DPA in the form of the relevant audits or certifications listed in the Security Addendum. Such audits are performed (a) at least once annually; (b) according to ISO 27001 standards or such other alternative standards that are substantially equivalent to ISO 27001; and (c) by independent third party security professionals selected by Databricks. Such audits result in the generation of a confidential audit report ("Audit Report").
• 7.27.2. Audit. Only to the extent Customer cannot reasonably satisfy Databricks compliance with this DPA through the Audit Reports, or where required by Applicable Data Protection Laws, Customer may send a written request to conduct an audit of Databricks applicable controls on an annual basis. Databricks and Customer shall mutually agree on the details of the audit, including the reasonable start date, scope and duration of, and security and confidentiality controls applicable to, any such audit. The Audit Report, audit, and any information arising therefrom shall be considered Databricks Confidential Information and may only be shared with a third party (including a third party controller) with Databricks prior written agreement.

88. TRANSFER OF PERSONAL DATA

• 8.18.1. Restricted Transfers. Where the transfer of Customer Personal Data to Databricks is a Restricted Transfer, such transfer shall be governed by the Standard Contractual Clauses, which shall be deemed incorporated into and form an integral part of the Agreement in accordance with Annex B of this DPA.
• 8.28.2. Alternative Transfer Mechanisms. If and to the extent that a court of competent jurisdiction or a supervisory authority with binding authority orders (for whatever reason) that the measures described in this DPA cannot be relied on to lawfully transfer Customer Personal Data to Databricks, the parties shall reasonably cooperate to agree and take any actions that may be reasonably required to implement any additional measures or alternative transfer mechanism to enable the lawful transfer of such Customer Personal Data. Additionally, in the event Databricks adopts an alternative transfer mechanism (including any successor version of the Privacy Shield), such alternative transfer mechanism shall apply instead of the SCCs described in Section 8.1 of this DPA (but only to the extent such alternative transfer mechanism complies with applicable European Data Protection Laws and extends to the territories to which Customer Personal Data is transferred).

99. BACKUP, DELETION & RETURN

• 9.19.1. No Backups. The Databricks Services do not include backup services or disaster recovery for Customer Personal Data. Databricks does provide functionality within the Databricks Services that may permit Customer to backup certain Customer Personal Data on its own. It is the Customer's obligation to backup any Customer Personal Data if desired.
• 9.29.2. Deletion. The Databricks Services include controls that Customer may use at any time during the term of the Agreement to retrieve or delete Customer Personal Data. Subject to the terms of the Agreement, Databricks will delete Customer Personal Data from the Databricks Services when Customer uses such controls to send an instruction to delete.
• 9.39.3. Termination. Upon termination or expiration of the Agreement and following Customer's written request, Databricks will delete or assist Customer in deleting any Customer Personal Data within its possession or control within thirty (30) days following such request.

1010. CCPA COMPLIANCE

• 10.110.1. Databricks shall not process, retain, use, or disclose Customer Personal Data for any purpose other than for the purposes set out in the Agreement, DPA and as permitted under the CCPA. Databricks shall not sell or share information as those terms are defined under the CCPA.

1111. GENERAL

• 11.111.1. The parties agree that this DPA shall replace any existing data processing addendum, attachment, exhibit or standard contractual clauses that the parties may have previously entered into in connection with the Databricks Services. Databricks may update this DPA from time to time, with such updated version posted to http://databricks/dpa or a successor website designated by Databricks; provided, however, that no such update shall materially diminish the privacy or security of Customer Personal Data.
• 11.211.2. If any part of this DPA is held unenforceable, the validity of all remaining parts will not be affected.
• 11.311.3. Databricks' obligations set forth in this DPA shall also extend to Authorized Affiliates, subject to the following conditions: (a) Customer is solely responsible for communicating any additional processing instructions on behalf of its Authorized Affiliates; (b) Customer shall be responsible for Authorized Affiliates' compliance with this DPA and all acts and/or omissions by an Authorized Affiliate with respect to Customer's obligations under this DPA; and (c) if an Authorized Affiliate seeks to assert a legal demand, action, suit, claim, proceeding or otherwise against Databricks ("Authorized Affiliate Claim"), Customer must bring such Authorized Affiliate Claim directly against Databricks on behalf of such Authorized Affiliate, unless Applicable Data Protection Laws require the Authorized Affiliate be a party to such claim, and all Authorized Affiliate Claims shall be considered claims made by Customer and shall be subject to any liability restrictions set forth in the Agreement, including any aggregate limitation of liability. In no event will this DPA or any party restrict or limit the rights of any data subject or of any competent supervisory authority.
• 11.411.4. In the event of any conflict between this DPA and any data privacy provisions set out in any agreements between the parties relating to the Databricks Services, the parties agree that the terms of this DPA shall prevail, provided that if and to the extent the Standard Contractual Clauses conflict with any provision of this DPA, the Standard Contractual Clauses control and take precedence. If there is any conflict between this DPA and a Business Associate Agreement entered into between the parties ("BAA"), then the BAA shall prevail to the extent of any conflict solely with respect to any PHI (as defined in such BAA).
• 11.511.5. Notwithstanding anything to the contrary in the Agreement or this DPA and to the maximum extent permitted by law, each party's and all of its Affiliates' liability, taken together in the aggregate, arising out of or related to this DPA (including all Annexes hereto), the SCCs or any data protection agreements in connection with the Agreement (if any), whether in contract, tort or under any other theory of liability, shall remain subject to the limitation of liability section of the Agreement and any reference in such section to the liability of a party means the aggregate liability of that party and all of its Affiliates under the Agreement and this DPA, including all Annexes hereto. Customer agrees that any regulatory penalties incurred by Databricks that arise in connection with Customer's failure to comply with its obligations under this DPA or any laws or regulations including Applicable Data Protection Laws shall reduce Databricks' liability under the Agreement as if such penalties were liabilities to Customer under the Agreement.
• 11.611.6. This DPA will be governed by and construed in accordance with the governing law and jurisdiction provisions in the Agreement, unless required otherwise by Applicable Data Protection Laws.
• 11.711.7. The obligations placed upon each party under this DPA and the Standard Contractual Clauses shall survive so long as Databricks processes Customer Personal Data on behalf of Customer. [SIGNATURE PAGE FOLLOWS]

·Signature pages provided in Databricks' automated signature workflow

Annex AANNEX A

·DESCRIPTION OF THE PROCESSING / TRANSFER

Annex BANNEX B

·STANDARD CONTRACTUAL CLAUSES (Modules 2 and 3)

• 11. Subject to Section 8.1 of the DPA, where the transfer of Customer Personal Data to Databricks is a Restricted Transfer and Applicable Data Protection Laws require that appropriate safeguards are put in place, such transfer shall be governed by the Standard Contractual Clauses, which shall be deemed incorporated into and form part of the DPA as follows:
• 2In relation to transfers of Customer Personal Data protected by the EU GDPR, the SCCs shall apply as follows:
• 3Module Two terms shall apply (where Customer is the controller of Customer Personal Data) and the Module Three terms shall apply (where Customer is the processor of Customer Personal Data);
• 4in Clause 7, the optional docking clause shall apply and Authorized Affiliates may accede the SCCs under the same terms and conditions as Customer, subject to mutual agreement of the parties;
• 5in Clause 9, option 2 ("general authorization") is selected, and the process and time period for prior notice of Sub-processor changes shall be as set out in Section 4.3 of the DPA;
• 6in Clause 11, the optional language shall not apply;
• 7in Clause 17, option 1 shall apply and the SCCs shall be governed by Irish law;
• 8in Clause 18(b), disputes shall be resolved before the courts of Ireland;
• Annex IAnnex I shall be deemed completed with the information set out in Annex A to the DPA; and
• Annex IIAnnex II shall be deemed completed with the information set out in the Security Addendum, subject to Section 6.1 (Security Measures) of the DPA.
• 11In relation to transfers of Customer Personal Data protected by the UK GDPR, the SCCs as implemented under Section 1(a) above shall apply with the following modifications:
• 12the SCCs shall be modified and interpreted in accordance with Part 2 of the UK Addendum, which shall be deemed incorporated into and form an integral part of the DPA;
• 13Tables 1, 2 and 3 in Part 1 of the UK Addendum shall be deemed completed with the information set out in Annex A and Annex B to the DPA and the Security Addendum respectively, and Table 4 in Part 1 of the UK Addendum shall be deemed completed by selecting "neither party"; and
• 14Any conflict between the terms of the SCCs and the UK Addendum will be resolved in accordance with Section 10 and Section 11 of the UK Addendum.
• 15In relation to transfers of Customer Personal Data protected by the Swiss Data Protection Act, the SCCs as implemented under Section 1(a) above will apply with the following modifications:
• 16references to "Regulation (EU) 2016/679" and specific articles therein shall be interpreted as references to the Swiss Data Protection Act and the equivalent articles or sections therein;
• 17references to "EU", "Union", "Member State" and "Member State law" shall be replaced with references to "Switzerland" and/or "Swiss law" (as applicable);
• 18references to the "competent supervisory authority" and "competent courts" shall be replaced with references to the "Swiss Federal Data Protection Information Commissioner" and "applicable courts of Switzerland");
• 19the SCCs shall be governed by the laws of Switzerland ; and
• 20disputes shall be resolved before the competent Swiss courts.
• 22. Where the Standard Contractual Clauses apply pursuant to Section 8.1 of this DPA, this section sets out the parties' interpretations of their respective obligations under specific provisions of the Clauses, as identified below. Where a

Part Yparty complies with the interpretations set out below, that party shall be deemed by the other party to have complied with its commitments under the Standard Contractual Clauses:

• 1where Customer is itself a processor of Customer Personal Data acting on behalf of a third party controller and Databricks would otherwise be required to interact directly with such third party controller (including notifying or obtaining authorizations from such third party controller), Databricks may interact solely with Customer and Customer shall be responsible for forwarding any necessary notifications to and obtaining any necessary authorizations from such third party controller;
• 2the certification of deletion described in Clause 16(d) of the SCCs shall be provided by Databricks to Customer upon Customer's written request;
• 3for the purposes of Clause 15(1)(a) the SCCs, Databricks shall notify Customer and not the relevant data subject(s) in case of government access requests, and Customer shall be solely responsible for notifying the relevant data subjects as necessary; and
• 4Taking into account the nature of the processing, Customer agrees that it is unlikely that Databricks would become aware of Customer Personal Data processed by Databricks is inaccurate or outdated. To the extent Databricks becomes aware of such inaccurate or outdated data, Databricks will inform the Customer in accordance with Clause 8.4 SCCs.