(1) Arcamus Enterprise Limited, a company incorporated in England and Wales with registered number 16824786 and registered office at 14 Bank Chambers, 25 Jermyn Street, London SW1Y 6HR ("Provider", acting as Processor); and

(1) Arcamus Enterprise Limited, a company incorporated in England and Wales with registered number 16824786 and registered office at 14 Bank Chambers, 25 Jermyn Street, London SW1Y 6HR ("Provider", acting as Processor); and

(2) The Customer (as defined in the EULA) ("Customer", acting as Controller).

(2) The Customer (as defined in the EULA) ("Customer", acting as Controller).

(each a "Party" and together the "Parties").

(each a "Party" and together the "Parties").

1.1 In this DPA, unless the context requires otherwise:

1.1 In this DPA, unless the context requires otherwise:

1.2 References to statutes include any modifications, amendments, consolidations or re-enactments.

1.2 References to statutes include any modifications, amendments, consolidations or re-enactments.

1.3 In the event of any conflict between this DPA and the EULA in relation to the processing of Personal Data, this DPA prevails.

1.3 In the event of any conflict between this DPA and the EULA in relation to the processing of Personal Data, this DPA prevails.

2.1 Scope. This DPA applies where, and only to the extent that, Provider Processes Personal Data as Processor on behalf of Customer in connection with the Platform.

2.1 Scope. This DPA applies where, and only to the extent that, Provider Processes Personal Data as Processor on behalf of Customer in connection with the Platform.

2.2 Controller and Processor. For the purposes of this DPA and the processing contemplated by it, Customer is the Controller and Provider is the Processor. Where Customer is itself a processor acting on behalf of a third party controller, Provider shall be a sub-processor and Customer warrants it has authority to engage Provider on the terms of this DPA.

2.2 Controller and Processor. For the purposes of this DPA and the processing contemplated by it, Customer is the Controller and Provider is the Processor. Where Customer is itself a processor acting on behalf of a third party controller, Provider shall be a sub-processor and Customer warrants it has authority to engage Provider on the terms of this DPA.

2.3 Provider as independent Controller. Provider Processes certain Personal Data as an independent Controller, including (a) Personal Data contained in public sector and publicly available sources that Provider aggregates and enriches to produce the Content (such as names of public sector officials, company directors and officers); (b) account administration data of Customer's authorised Users; (c) Derived Data (as defined in the EULA); and (d) telemetry, security and usage data of the Platform. This DPA does not apply to such processing, which is governed by Provider's Privacy Notice, available at arcamus.com/privacy.

2.3 Provider as independent Controller. Provider Processes certain Personal Data as an independent Controller, including (a) Personal Data contained in public sector and publicly available sources that Provider aggregates and enriches to produce the Content (such as names of public sector officials, company directors and officers); (b) account administration data of Customer's authorised Users; (c) Derived Data (as defined in the EULA); and (d) telemetry, security and usage data of the Platform. This DPA does not apply to such processing, which is governed by Provider's Privacy Notice, available at arcamus.com/privacy.

2.4 Details of processing. The subject matter, duration, nature and purpose of the processing, the types of Personal Data and categories of Data Subjects are set out in Annex 1 (Details of Processing).

2.4 Details of processing. The subject matter, duration, nature and purpose of the processing, the types of Personal Data and categories of Data Subjects are set out in Annex 1 (Details of Processing).

3.1 Lawful basis and instructions. Customer is responsible for (a) establishing and maintaining a valid lawful basis for the processing of Personal Data under this DPA; (b) ensuring its instructions to Provider comply with Data Protection Laws; and (c) providing all notices and obtaining all consents, authorisations and rights required to enable Provider to process Personal Data as contemplated by this DPA and the EULA.

3.1 Lawful basis and instructions. Customer is responsible for (a) establishing and maintaining a valid lawful basis for the processing of Personal Data under this DPA; (b) ensuring its instructions to Provider comply with Data Protection Laws; and (c) providing all notices and obtaining all consents, authorisations and rights required to enable Provider to process Personal Data as contemplated by this DPA and the EULA.

3.2 Documented instructions. Provider shall process Personal Data only on documented instructions from Customer, including with regard to transfers of Personal Data to a third country or international organisation, unless required to do so by UK or EU law to which Provider is subject. In that case, Provider shall inform Customer of that legal requirement before processing, unless prohibited by law on important grounds of public interest.

3.2 Documented instructions. Provider shall process Personal Data only on documented instructions from Customer, including with regard to transfers of Personal Data to a third country or international organisation, unless required to do so by UK or EU law to which Provider is subject. In that case, Provider shall inform Customer of that legal requirement before processing, unless prohibited by law on important grounds of public interest.

3.3 Standing instructions. Customer's documented instructions to Provider at the date of this DPA are: (a) to process Personal Data as necessary to provide, operate, secure, maintain and support the Platform in accordance with the EULA; (b) to process Personal Data as described in Annex 1; and (c) to comply with any further written instructions issued by Customer through the Platform or in writing to Provider, provided such instructions are consistent with the EULA.

3.3 Standing instructions. Customer's documented instructions to Provider at the date of this DPA are: (a) to process Personal Data as necessary to provide, operate, secure, maintain and support the Platform in accordance with the EULA; (b) to process Personal Data as described in Annex 1; and (c) to comply with any further written instructions issued by Customer through the Platform or in writing to Provider, provided such instructions are consistent with the EULA.

3.4 Additional instructions. Where Customer issues instructions beyond those contemplated by the EULA or this DPA, Provider may (a) charge Customer a reasonable fee for complying; or (b) decline to comply where compliance would materially increase Provider's obligations, risks or costs, or require changes to the Platform.

3.4 Additional instructions. Where Customer issues instructions beyond those contemplated by the EULA or this DPA, Provider may (a) charge Customer a reasonable fee for complying; or (b) decline to comply where compliance would materially increase Provider's obligations, risks or costs, or require changes to the Platform.

3.5 Prohibition on unlawful instructions. If Provider considers that an instruction from Customer infringes Data Protection Laws, Provider shall inform Customer promptly and may suspend performance of the relevant instruction pending resolution.

3.5 Prohibition on unlawful instructions. If Provider considers that an instruction from Customer infringes Data Protection Laws, Provider shall inform Customer promptly and may suspend performance of the relevant instruction pending resolution.

3.6 Prohibited data. Customer shall not submit to the Platform any Special Category Data, Personal Data relating to criminal convictions and offences, children's data, or any Personal Data subject to heightened legal, regulatory or contractual restriction, without Provider's prior written agreement and, where relevant, an executed addendum to this DPA.

3.6 Prohibited data. Customer shall not submit to the Platform any Special Category Data, Personal Data relating to criminal convictions and offences, children's data, or any Personal Data subject to heightened legal, regulatory or contractual restriction, without Provider's prior written agreement and, where relevant, an executed addendum to this DPA.

4.1 Provider shall ensure that any person authorised to process Personal Data on its behalf is (a) subject to a duty of confidence, whether contractual or statutory; and (b) processes Personal Data only on instructions from Provider consistent with this DPA, unless required by law to do otherwise.

4.1 Provider shall ensure that any person authorised to process Personal Data on its behalf is (a) subject to a duty of confidence, whether contractual or statutory; and (b) processes Personal Data only on instructions from Provider consistent with this DPA, unless required by law to do otherwise.

4.2 Provider shall ensure that access to Personal Data is limited to those personnel who need access for the purposes of providing the Platform or performing Provider's obligations under the EULA and this DPA.

4.2 Provider shall ensure that access to Personal Data is limited to those personnel who need access for the purposes of providing the Platform or performing Provider's obligations under the EULA and this DPA.

5.1 Provider shall implement and maintain appropriate technical and organisational measures to protect Personal Data against unauthorised or unlawful processing, accidental loss, destruction or damage, taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of processing, and the risks to Data Subjects.

5.1 Provider shall implement and maintain appropriate technical and organisational measures to protect Personal Data against unauthorised or unlawful processing, accidental loss, destruction or damage, taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of processing, and the risks to Data Subjects.

5.2 Provider's technical and organisational measures are described in Annex 2 (Technical and Organisational Measures). Provider may update Annex 2 from time to time, provided it does not materially reduce the overall level of protection afforded to Personal Data.

5.2 Provider's technical and organisational measures are described in Annex 2 (Technical and Organisational Measures). Provider may update Annex 2 from time to time, provided it does not materially reduce the overall level of protection afforded to Personal Data.

5.3 Customer acknowledges that the measures in Annex 2 are appropriate for the types of Personal Data and risks contemplated by this DPA, and that Customer is responsible for evaluating the measures and determining whether they meet Customer's own requirements.

5.3 Customer acknowledges that the measures in Annex 2 are appropriate for the types of Personal Data and risks contemplated by this DPA, and that Customer is responsible for evaluating the measures and determining whether they meet Customer's own requirements.

6.1 General authorisation. Customer grants Provider general written authorisation to engage Sub-processors to Process Personal Data, subject to this Clause 6. The Sub-processors engaged by Provider at the date of this DPA are listed in Annex 3 (Sub-processors).

6.1 General authorisation. Customer grants Provider general written authorisation to engage Sub-processors to Process Personal Data, subject to this Clause 6. The Sub-processors engaged by Provider at the date of this DPA are listed in Annex 3 (Sub-processors).

6.2 Notification of changes. Provider shall notify Customer of any intended addition or replacement of Sub-processors at least 14 days before engaging the new Sub-processor (or such shorter period as may be reasonable in the case of an emergency replacement required to maintain service continuity or security). Notification may be by email to Customer's designated contact or by update to a list published at a URL notified to Customer from time to time.

6.2 Notification of changes. Provider shall notify Customer of any intended addition or replacement of Sub-processors at least 14 days before engaging the new Sub-processor (or such shorter period as may be reasonable in the case of an emergency replacement required to maintain service continuity or security). Notification may be by email to Customer's designated contact or by update to a list published at a URL notified to Customer from time to time.

6.3 Objection. Customer may object on reasonable data protection grounds to any new Sub-processor within 14 days of notification, by giving Provider written notice specifying the grounds. The Parties shall discuss the objection in good faith. If the Parties cannot resolve the objection within 30 days, Customer may terminate the affected portion of the subscription on written notice, and Provider shall refund any prepaid Fees for the unused portion of the Subscription Term pro rata. Absent a timely objection, the new Sub-processor is deemed accepted.

6.3 Objection. Customer may object on reasonable data protection grounds to any new Sub-processor within 14 days of notification, by giving Provider written notice specifying the grounds. The Parties shall discuss the objection in good faith. If the Parties cannot resolve the objection within 30 days, Customer may terminate the affected portion of the subscription on written notice, and Provider shall refund any prepaid Fees for the unused portion of the Subscription Term pro rata. Absent a timely objection, the new Sub-processor is deemed accepted.

6.4 Flow-down obligations. Provider shall impose on each Sub-processor, by written contract, data protection obligations materially equivalent to those in this DPA, including the obligations in Clauses 4 (Confidentiality) and 5 (Security).

6.4 Flow-down obligations. Provider shall impose on each Sub-processor, by written contract, data protection obligations materially equivalent to those in this DPA, including the obligations in Clauses 4 (Confidentiality) and 5 (Security).

6.5 Liability for Sub-processors. Provider remains liable to Customer for the acts and omissions of its Sub-processors in respect of the obligations owed by Provider under this DPA, subject to the limitations in Clause 13 and the liability provisions of the EULA.

6.5 Liability for Sub-processors. Provider remains liable to Customer for the acts and omissions of its Sub-processors in respect of the obligations owed by Provider under this DPA, subject to the limitations in Clause 13 and the liability provisions of the EULA.

7.1 Provider shall, taking into account the nature of the processing and insofar as possible, assist Customer by appropriate technical and organisational measures to enable Customer to fulfil its obligation to respond to requests from Data Subjects exercising their rights under Data Protection Laws.

7.1 Provider shall, taking into account the nature of the processing and insofar as possible, assist Customer by appropriate technical and organisational measures to enable Customer to fulfil its obligation to respond to requests from Data Subjects exercising their rights under Data Protection Laws.

7.2 If Provider receives a request from a Data Subject directly in relation to Personal Data processed on behalf of Customer, Provider shall, unless legally prohibited, (a) not respond to the request directly without Customer's prior authorisation, and (b) promptly notify Customer and provide reasonable information to enable Customer to respond.

7.2 If Provider receives a request from a Data Subject directly in relation to Personal Data processed on behalf of Customer, Provider shall, unless legally prohibited, (a) not respond to the request directly without Customer's prior authorisation, and (b) promptly notify Customer and provide reasonable information to enable Customer to respond.

7.3 Where Customer is unable to access, rectify, restrict, erase or port Personal Data through the Platform's self-service functionality, Provider shall provide reasonable assistance. Provider may charge a reasonable fee for assistance that is manifestly unfounded, excessive or outside the scope of the standard Platform functionality.

7.3 Where Customer is unable to access, rectify, restrict, erase or port Personal Data through the Platform's self-service functionality, Provider shall provide reasonable assistance. Provider may charge a reasonable fee for assistance that is manifestly unfounded, excessive or outside the scope of the standard Platform functionality.

8.1 Provider shall notify Customer without undue delay, and in any event within 72 hours of becoming aware, of any Personal Data Breach affecting Personal Data processed on behalf of Customer.

8.1 Provider shall notify Customer without undue delay, and in any event within 72 hours of becoming aware, of any Personal Data Breach affecting Personal Data processed on behalf of Customer.

8.2 Provider's notification shall describe, to the extent known at the time and subject to subsequent update as further information becomes available: (a) the nature of the Personal Data Breach, including (where possible) the categories and approximate number of Data Subjects and records concerned; (b) the name and contact details of Provider's data protection contact; (c) the likely consequences of the Personal Data Breach; and (d) the measures taken or proposed to address the Personal Data Breach, including measures to mitigate possible adverse effects.

8.2 Provider's notification shall describe, to the extent known at the time and subject to subsequent update as further information becomes available: (a) the nature of the Personal Data Breach, including (where possible) the categories and approximate number of Data Subjects and records concerned; (b) the name and contact details of Provider's data protection contact; (c) the likely consequences of the Personal Data Breach; and (d) the measures taken or proposed to address the Personal Data Breach, including measures to mitigate possible adverse effects.

8.3 Provider shall provide reasonable cooperation and information to assist Customer in meeting its own obligations under Data Protection Laws, including in notifying supervisory authorities and affected Data Subjects where required.

8.3 Provider shall provide reasonable cooperation and information to assist Customer in meeting its own obligations under Data Protection Laws, including in notifying supervisory authorities and affected Data Subjects where required.

8.4 Notification under this Clause 8 is not an acknowledgment by Provider of fault or liability in respect of the Personal Data Breach.

8.4 Notification under this Clause 8 is not an acknowledgment by Provider of fault or liability in respect of the Personal Data Breach.

Provider shall, taking into account the nature of the processing and information available to it, provide reasonable assistance to Customer in fulfilling Customer's obligations under Articles 35 and 36 of the UK GDPR (Data Protection Impact Assessments and prior consultation with supervisory authorities). Provider may charge a reasonable fee for such assistance where it materially exceeds the routine information Provider makes available through Annex 2 and standard Platform documentation.

Provider shall, taking into account the nature of the processing and information available to it, provide reasonable assistance to Customer in fulfilling Customer's obligations under Articles 35 and 36 of the UK GDPR (Data Protection Impact Assessments and prior consultation with supervisory authorities). Provider may charge a reasonable fee for such assistance where it materially exceeds the routine information Provider makes available through Annex 2 and standard Platform documentation.

10.1 Provider shall not transfer or authorise a Sub-processor to transfer Personal Data to a country outside the UK (and, where applicable, outside the EEA) unless an appropriate transfer mechanism is in place.

10.1 Provider shall not transfer or authorise a Sub-processor to transfer Personal Data to a country outside the UK (and, where applicable, outside the EEA) unless an appropriate transfer mechanism is in place.

10.2 UK transfers. For Restricted Transfers from the UK, the Parties agree that the UK IDTA shall apply, with Annex 4 (Transfer Mechanisms) completing the required tables. Alternatively, the Parties may rely on the EU SCCs as amended by the UK Addendum, with Annex 4 completing the required annexes and the UK Addendum tables.

10.2 UK transfers. For Restricted Transfers from the UK, the Parties agree that the UK IDTA shall apply, with Annex 4 (Transfer Mechanisms) completing the required tables. Alternatively, the Parties may rely on the EU SCCs as amended by the UK Addendum, with Annex 4 completing the required annexes and the UK Addendum tables.

10.3 EU transfers. Where Personal Data originates in the EEA and is subject to the EU GDPR, Restricted Transfers shall be governed by the EU SCCs, Module 2 (Controller to Processor) or Module 3 (Processor to Processor) as applicable, with Annex 4 completing the required annexes.

10.3 EU transfers. Where Personal Data originates in the EEA and is subject to the EU GDPR, Restricted Transfers shall be governed by the EU SCCs, Module 2 (Controller to Processor) or Module 3 (Processor to Processor) as applicable, with Annex 4 completing the required annexes.

10.4 Precedence. Where a transfer mechanism in Clauses 10.2 or 10.3 applies, its terms prevail over this DPA to the extent of any conflict in relation to the relevant Restricted Transfer.

10.4 Precedence. Where a transfer mechanism in Clauses 10.2 or 10.3 applies, its terms prevail over this DPA to the extent of any conflict in relation to the relevant Restricted Transfer.

10.5 Transfer impact assessment. Each Party shall cooperate in good faith to complete any transfer impact assessment reasonably required to support a lawful Restricted Transfer.

10.5 Transfer impact assessment. Each Party shall cooperate in good faith to complete any transfer impact assessment reasonably required to support a lawful Restricted Transfer.

11.1 On termination or expiry of the EULA, Provider shall, at Customer's option (to be exercised in writing within 30 days of termination or expiry), either (a) return to Customer all Personal Data processed on behalf of Customer, in a structured, commonly used format; or (b) delete all such Personal Data, save to the extent retention is required by applicable law.

11.1 On termination or expiry of the EULA, Provider shall, at Customer's option (to be exercised in writing within 30 days of termination or expiry), either (a) return to Customer all Personal Data processed on behalf of Customer, in a structured, commonly used format; or (b) delete all such Personal Data, save to the extent retention is required by applicable law.

11.2 If Customer does not exercise either option within the 30-day period, Provider may delete the Personal Data.

11.2 If Customer does not exercise either option within the 30-day period, Provider may delete the Personal Data.

11.3 Provider may retain Personal Data contained in secure backup media pending scheduled overwriting or deletion in the ordinary course, subject to continuing confidentiality and security obligations under this DPA and the EULA.

11.3 Provider may retain Personal Data contained in secure backup media pending scheduled overwriting or deletion in the ordinary course, subject to continuing confidentiality and security obligations under this DPA and the EULA.

11.4 On Customer's request, Provider shall certify in writing that it has complied with this Clause 11.

11.4 On Customer's request, Provider shall certify in writing that it has complied with this Clause 11.

12.1 Information. Provider shall make available to Customer all information reasonably necessary to demonstrate compliance with this DPA, including by providing, on request, (a) its most recent independent third-party audit report (such as SOC 2 Type II or ISO 27001 certification), redacted as necessary to protect confidentiality or security; and (b) completed security questionnaires where reasonably requested.

12.1 Information. Provider shall make available to Customer all information reasonably necessary to demonstrate compliance with this DPA, including by providing, on request, (a) its most recent independent third-party audit report (such as SOC 2 Type II or ISO 27001 certification), redacted as necessary to protect confidentiality or security; and (b) completed security questionnaires where reasonably requested.

12.2 Audit. Subject to this Clause 12, Customer (or a mandated independent third-party auditor bound by confidentiality obligations equivalent to those in this DPA and the EULA, and not being a competitor of Provider) may, on reasonable prior written notice of at least 30 days (or less in the case of a regulator-mandated or incident-driven audit), conduct an audit of Provider's processing of Personal Data under this DPA.

12.2 Audit. Subject to this Clause 12, Customer (or a mandated independent third-party auditor bound by confidentiality obligations equivalent to those in this DPA and the EULA, and not being a competitor of Provider) may, on reasonable prior written notice of at least 30 days (or less in the case of a regulator-mandated or incident-driven audit), conduct an audit of Provider's processing of Personal Data under this DPA.

12.3 Audit conditions. Any audit shall (a) be limited to matters necessary to verify compliance with this DPA; (b) be conducted during normal business hours; (c) last no longer than 5 Business Days; (d) occur no more than once in any 12-month period, save where a regulator requires it or following a Personal Data Breach materially affecting Customer; (e) avoid disruption to Provider's operations and to other customers; and (f) not grant access to Personal Data of other customers, Confidential Information of third parties, or systems where access would create a security risk.

12.3 Audit conditions. Any audit shall (a) be limited to matters necessary to verify compliance with this DPA; (b) be conducted during normal business hours; (c) last no longer than 5 Business Days; (d) occur no more than once in any 12-month period, save where a regulator requires it or following a Personal Data Breach materially affecting Customer; (e) avoid disruption to Provider's operations and to other customers; and (f) not grant access to Personal Data of other customers, Confidential Information of third parties, or systems where access would create a security risk.

12.4 Audit costs. Customer shall bear its own costs of any audit and shall reimburse Provider's reasonable costs of supporting the audit, unless the audit reveals a material breach by Provider, in which case Provider shall bear the reasonable costs of the audit.

12.4 Audit costs. Customer shall bear its own costs of any audit and shall reimburse Provider's reasonable costs of supporting the audit, unless the audit reveals a material breach by Provider, in which case Provider shall bear the reasonable costs of the audit.

12.5 Regulator audits. Nothing in this Clause 12 limits the audit or inspection rights of a competent supervisory authority.

12.5 Regulator audits. Nothing in this Clause 12 limits the audit or inspection rights of a competent supervisory authority.

13.1 Subject to Clause 13.2, the liability of each Party under or in connection with this DPA (howsoever arising, whether in contract, tort (including negligence), breach of statutory duty or otherwise) shall be subject to the exclusions and limitations of liability set out in the EULA. For the avoidance of doubt, liability under this DPA counts towards, and does not increase or sit outside, the aggregate liability caps in the EULA, save as expressly provided in the EULA.

13.1 Subject to Clause 13.2, the liability of each Party under or in connection with this DPA (howsoever arising, whether in contract, tort (including negligence), breach of statutory duty or otherwise) shall be subject to the exclusions and limitations of liability set out in the EULA. For the avoidance of doubt, liability under this DPA counts towards, and does not increase or sit outside, the aggregate liability caps in the EULA, save as expressly provided in the EULA.

13.2 Nothing in this DPA or the EULA excludes or limits liability that cannot lawfully be excluded or limited, or excludes or limits the direct liability of either Party to Data Subjects or supervisory authorities under Data Protection Laws.

13.2 Nothing in this DPA or the EULA excludes or limits liability that cannot lawfully be excluded or limited, or excludes or limits the direct liability of either Party to Data Subjects or supervisory authorities under Data Protection Laws.

13.3 Where the Parties are jointly liable to a Data Subject for the same damage arising from a breach of Data Protection Laws, each Party's share of liability as between themselves shall reflect their respective responsibility for the damage.

13.3 Where the Parties are jointly liable to a Data Subject for the same damage arising from a breach of Data Protection Laws, each Party's share of liability as between themselves shall reflect their respective responsibility for the damage.

14.1 This DPA takes effect on the Effective Date of the EULA and continues in force until the EULA terminates or expires, save that Clauses 4 (Confidentiality), 11 (Return and Deletion), 12 (Audit, to the extent relating to processing carried out during the term) and 13 (Liability) survive termination to the extent necessary to give effect to the Parties' rights and obligations.

14.1 This DPA takes effect on the Effective Date of the EULA and continues in force until the EULA terminates or expires, save that Clauses 4 (Confidentiality), 11 (Return and Deletion), 12 (Audit, to the extent relating to processing carried out during the term) and 13 (Liability) survive termination to the extent necessary to give effect to the Parties' rights and obligations.

14.2 Termination of this DPA does not relieve either Party of obligations under Data Protection Laws.

14.2 Termination of this DPA does not relieve either Party of obligations under Data Protection Laws.

15.1 Contact. Each Party's data protection contact is as set out in Annex 1. Either Party may update its contact by written notice to the other.

15.1 Contact. Each Party's data protection contact is as set out in Annex 1. Either Party may update its contact by written notice to the other.

15.2 Updates. Provider may update this DPA from time to time to reflect changes in Data Protection Laws, supervisory authority guidance, or the terms of standard contractual clauses or equivalent mechanisms. Material changes are subject to Clause 23 of the EULA (Changes to this EULA).

15.2 Updates. Provider may update this DPA from time to time to reflect changes in Data Protection Laws, supervisory authority guidance, or the terms of standard contractual clauses or equivalent mechanisms. Material changes are subject to Clause 23 of the EULA (Changes to this EULA).

15.3 Order of precedence. In the event of conflict between this DPA, the EULA, and any Order Form in relation to the processing of Personal Data, the order of precedence is (a) this DPA, (b) the EULA, (c) the Order Form, unless the Order Form expressly states it prevails over this DPA in respect of a specific matter.

15.3 Order of precedence. In the event of conflict between this DPA, the EULA, and any Order Form in relation to the processing of Personal Data, the order of precedence is (a) this DPA, (b) the EULA, (c) the Order Form, unless the Order Form expressly states it prevails over this DPA in respect of a specific matter.

15.4 Governing law and jurisdiction. This DPA is governed by the laws of England and Wales. The courts of England and Wales have exclusive jurisdiction, subject to any different jurisdiction specified in the UK IDTA or EU SCCs where they apply.

15.4 Governing law and jurisdiction. This DPA is governed by the laws of England and Wales. The courts of England and Wales have exclusive jurisdiction, subject to any different jurisdiction specified in the UK IDTA or EU SCCs where they apply.

F. Frequency of Transfers. Continuous, on an as-needed basis, for the duration of the Subscription Term.

F. Frequency of Transfers. Continuous, on an as-needed basis, for the duration of the Subscription Term.

G. Retention Period. Personal Data is retained for the duration of the Subscription Term and in accordance with Clause 11 of this DPA. Logs and telemetry processed on behalf of Customer are retained for up to 12 months or such other period as is necessary to maintain the security and integrity of the Platform.

G. Retention Period. Personal Data is retained for the duration of the Subscription Term and in accordance with Clause 11 of this DPA. Logs and telemetry processed on behalf of Customer are retained for up to 12 months or such other period as is necessary to maintain the security and integrity of the Platform.

Provider implements and maintains the following technical and organisational measures. Specific implementations may evolve over time; Provider will not materially reduce the overall level of protection.

Provider implements and maintains the following technical and organisational measures. Specific implementations may evolve over time; Provider will not materially reduce the overall level of protection.

The current list of Sub-processors engaged by Provider are listed at arcamus.com/subprocessors (or such other URL as Provider notifies). Provider shall notify Customer of changes in accordance with Clause 6 of this DPA.

The current list of Sub-processors engaged by Provider are listed at arcamus.com/subprocessors (or such other URL as Provider notifies). Provider shall notify Customer of changes in accordance with Clause 6 of this DPA.

Part 3 - UK Addendum. Where the Parties rely on the EU SCCs with the UK Addendum to effect a UK Restricted Transfer, the UK Addendum applies in its standard form with Table 2 selecting the EU SCCs referenced above, and with no additional provisions unless agreed in writing.

Part 3 - UK Addendum. Where the Parties rely on the EU SCCs with the UK Addendum to effect a UK Restricted Transfer, the UK Addendum applies in its standard form with Table 2 selecting the EU SCCs referenced above, and with no additional provisions unless agreed in writing.