General Purchase Terms and Conditions

DDB Amsterdam B.V.
November 2023
This document contains

(I) The General Purchase Terms and Conditions (“Purchase Conditions”) of DDB Amsterdam B.V., a company with its statutory seat in Amsterdam, The Netherlands, registered at the Dutch Chamber of Commerce under number 34117849;

(II) The Data Processing Agreement applicable to the processing of personal data by any Vendor who provides Materials and/or Services to DDB Amsterdam B.V.(Exhibit A)

Artikel 1. Definitions

In these Purchasing Conditions the following definitions below shall have the following meaning:

Agency: DDB Amsterdam B.V. purchaser of Materials and Services from Vendor and user of these Purchase Conditions
Agreement: any agreement, purchase order, offer, quotation and/or other legal relationship, accepted by Agency in writing, pursuant to which Vendor provides Materials and/or Services to Agency.
Client: the recipient of all rights and benefits under the Agreement.
Materials: any and all tangible or intangible materials including but not limited to trademarks, service marks, logos, designs, product names and descriptions, brand names, characters, trade dress, slogans, copies, scripts, commercials, advertisements, brochures, instruction manuals, storyboards, videos, films, packaging, signs, official contest and sweepstakes rules, domain names, websites, social media pages, social media accounts, social media posts, internet portals or telephone numbers for use in connection with the Services, printed materials, digital materials, photographs, illustrations, developed, designed, created, prepared presented, furnished, produced or provided pursuant to the Agreement by or on behalf of Vendor or its subcontractors, whether in preliminary, draft or final form, finished or unfinished, whether or not subject to intellectual property protection, and whether used or unused by Agency or its Client.
Services: any work performed by the Vendor pursuant to the Agreement.
Total Payment: the total payment amount set forth in the Agreement.
Vendor: the vendor who pursuant to the Agreement provides Materials and/or Services to Agency.

Artikel 2. Applicability

2.1 These Purchase Conditions apply to any Agreement regarding the Materials and/or Services provided by Vendor to Agency.

2.2 Applicability of the general terms and conditions of Vendor is explicitly excluded.

2.3 Agency is allowed to unilaterally amend these Purchase Conditions, and will inform Vendor of any amendments before they enter into force.

2.4 If any provision of these Purchase Conditions is or becomes non-binding, the remaining provisions shall remain in full force and effect.

2.5 In case of conflict between the provisions of the Agreement and the provisions of these Purchase Conditions, the provisions of the Agreement shall prevail.

Artikel 3. Liability

3.1 The Vendor is liable for all damages, suffered by Agency, Client and/or third parties as a result of any breach of its obligations pursuant to the Order, the Purchase Conditions and/or as a result of wrongful acts or omissions of the Vendor, its personnel and/or third parties engaged by it.

3.2 Any and all liability of Agency and/or Client pursuant to the Order, the Purchase Conditions or as a result of wrongful acts or omissions or otherwise is at all times limited to the sum insured that shall be paid in such case under the professional liability insurance policies taken out by Agency and/or Client, unless the damage was caused by intent or willful recklessness of Agency and/or its employees.

Artikel 4. Intellectual property rights

4.1 Vendor warrants that the use of the Materials and/or Services provided by Vendor will not infringe any intellectual property rights of third parties.

4.2 All intellectual property rights in the Materials and/or Services rest solely with Agency.

4.3 Should this not be the case, Vendor shall assign all intellectual property rights in the Materials and/or Services to Agency and is obliged to do anything necessary to constitute a legally valid assignment of these intellectual property rights to Agency, including but not limited to signing a deed of assignment regarding these rights.

4.4 All intellectual property rights vested in any materials provided by Agency and/or Client in performance of the Agreement shall remain exclusively with Agency and/or Client.

Artikel 5. Warranty and indemnification

5.1 Vendor warrants that the Materials and/or Services to be provided to Agency :

(i) are in terms of quality, quantity and description in accordance with the Agreement and all specifications and requirements supplied

or communicated by the Agency to the Vendor;

(ii) will be delivered at the agreed time or within the delivery period(s)as specified in the Agreement or otherwise agreed in writing;

(iii) will be free of any defects;

(iv) will be suitable for the purposes for which these Materials and/or Services are normally used and for any specific purpose made

known by Vendor to Agency;

(v) do not infringe any third-party intellectual property rights.

5.2 Vendor shall indemnify Agency and/or Client from and against all its damages and claims of third party’s resulting from any breach by Vendor of the obligations under the Agreement, the Purchase Conditions and/or any wrongful act by Vendor.

Artikel 6. Force Majeure

6.1 If Vendor due to a force majeure event is unable to produce and deliver the Materials and/or Services pursuant to the Agreement, Agency shall have the right to terminate the Agreement or accept reduced deliveries of the Materials and/or Services.

6.2 In the event of termination of the Agreement, Agency and Client shall not be obliged to make any further payments to Vendor.

6.3 If Agency accepts reduced deliveries of the Materials and/or Services as referred to in article 6.1, Agency may procure substitute Materials and/or Services from other sources, in which event the Agreement shall be deemed modified to eliminate Vendor’s obligation to sell and Agency's and Client’s obligation to purchase such substituted Materials.

Artikel 7. Prices and payment

7.1 The prices stated in the Agreement with respect to the Materials and/or Services are fixed. Unless expressly agreed in writing between Agency and Vendor, prices are not subject to change.

7.2 Unless specified otherwise in the Agreement, the Total Payment shall be due not more than 60 days after the occurrence of the last of the following events: (a) receipt by Agency of Vendor's invoice in proper form including the PO number; (b) completion and delivery of all Materials and/or Services to be performed and delivered to Agency and Agency’s acceptance thereof; and (c) payment to Agency has been made by Client for the invoiced amount.

Artikel 8. Duration and cancellation

8.1 The Agreement between Agency and the Vendor is concluded for the period as indicated in the Agreement.

8.2 If no period is agreed in the Agreement, the Agreement shall end when the Materials and/or Services has been provided to Agency and Agency’s acceptance thereof.

8.3 Agency is allowed to cancel at any time all or part of the Agreement in their sole discretion upon notice to Vendor.

8.4 Notwithstanding the provisions of article 9 of the Purchase Conditions, Agency will pay Vendor all verified costs actually incurred and paid by Vendor in the creation and delivery of the Materials and/or provision of Services which are accepted by Agency prior to said termination.

Artikel 9. Suspension and termination

Agency is entitled to suspend all its obligations to the Vendor pursuant to the Agreement and the Purchase Conditions and/or to terminate the Agreement, wholly or partially, in both cases with immediate effect without prior notice of default and without being liable to Vendor for any damages in the event:

(i) Vendor has failed to fulfil one or more of its obligations pursuant to the Agreement or these Purchase Conditions; or

(ii) Vendor files for moratorium or bankruptcy/insolvency or a moratorium or bankruptcy/insolvency is applied in respect of Vendor; or

(iii) Vendor proceeds with the dissolution or liquidation of its business; or

(iv) the business of Vendor is continued in a different legal form or direct or indirect control over the Vendor is transferred to a third party.

Artikel 10. Confidentiality and data protection

10.1 The Vendor is obliged to observe confidentiality in respect of all information or data, verbally or in writing, provided by or on behalf of Agency and/or Client in connection with the Agreement (“Confidential Information”).

10.2 Vendor warrants that neither it nor its employees, agents or subcontractors will disclose Confidential Information to any third party, nor use the Confidential Information, except for internal use as is required to provide the Materials and/or Services, without the prior written consent of Agency.

10.3 The aforementioned restrictions do not apply in the event and to the extent that Confidential Information becomes publicly known as a result of the intentional disclosure of the Confidential Information by Agency or Client.

10.4 Vendor agrees to comply with the Data Processing Agreement set forth in Exhibit A whenever it is processing personal data as defined in the GDPR on behalf of Agency and/or the Client.

Artikel 11. Insurance

Vendor shall require at its own cost and maintain in full force and effect all types of insurances necessary to cover its performance of its obligations pursuant to the Agreement and/or the Purchase Conditions and any possible damages resulting from its liability under the Agreement and/or the Purchase Conditions.

Artikel 12. Choice of Law and forum

12.1 The Agreement and Purchase Conditions will be construed in accordance with the laws of the Netherlands, notwithstanding any conflict or choice of law principle to the contrary.

12.2 The applicability of The United Nations Convention on the International Sales of Goods is excluded.

12.3 All disputes arising out of or in connection with the Agreement and the Purchase Conditions will be resolved by the competent court in Amsterdam, to the exclusion of the jurisdiction of other courts.

Exhibit A

Data Processing Agreement

This Data Processing Agreement (“DPA”) sets forth the terms and conditions relating to the processing of personal data (as defined below) associated with services rendered by Vendor to Agency as agent for Client, or to Client if Agency is not acting as agent pursuant to the Agreement.

WHEREAS, Agency and/or Client or their employees, agents, consultants or contractors may provide Vendor with access to Personal Data in connection with certain services performed by Vendor for or on behalf of Agency or Client pursuant to the Agreement; and

WHEREAS, Agency and Client require that Vendor preserve and maintain the privacy, confidentiality, security and protection of such Personal Data.

NOW, THEREFORE, in consideration of Agency, as agent for Client, or as principal, entering to this DPA with Vendor, Agency and Vendor agree as follows:

I. Definitions.

(A) “Data Controller” means the entity that determines the purposes and means of the processing of Personal Data.

(B) “Data Processor” means any person or entity that Processes Personal Data on behalf of a Data Controller.

(C) “Data Subject” means an identified or identifiable natural person to which the Personal Data pertains.

(D) “European Data Protection Laws” means all applicable European Union (“EU”), European Economic Area (“EEA”) or national laws and regulations (including, without limitation, laws and regulations of the United Kingdom or Switzerland) relating to the privacy, confidentiality, security or protection of Personal Data, including, without limitation: the EU General Data Protection Regulation 2016/679 (“GDPR”) and laws or regulations implementing or supplementing the GDPR; the EU Directive 2002/58/EC (“e-Privacy Directive”), as replaced from time to time, and laws or regulations implementing or supplementing the e-Privacy Directive, including laws regulating the use of cookies, other tracking mechanisms and unsolicited e-mail communications.

(E) “Information Security Incident” means any actual or suspected unauthorized or accidental access to or loss, use, disclosure, modification, destruction, acquisition or Processing of any Personal Data.

(F) “Instructions” means the Agreement and any amendment or other written agreement or documentation through which the Data Controller instructs the Data Processor to perform specific Processing of Personal Data.

(G) “Notification Related Costs” means Agency’s or Client’s and its affiliates’ internal and external costs associated with investigating,

addressing and responding to an Information Security Incident, including but not limited to: (i) preparation and mailing or other transmission of any notifications or other communications to Agency or Client or their respective employees, agents or others as Agency or Client deems reasonably appropriate; (ii) establishment of a call center or other communications procedures in response to such Information Security Incident (e.g., Agency or Client service FAQs, talking points and training); (iii) public relations and other similar crisis management services; (iv) legal, accounting, consulting and forensic expert fees and expenses associated with Agency’s. Client’s and their affiliates’ investigation of and response to such Information Security Incident; and (v) costs for commercially reasonable credit monitoring, identity protection services or similar services that Agency or Client determines are advisable under the circumstances.

(H) “Personal Data” means any information that is Processed by Vendor in connection with the services specified in the Agreement (1) relating to an identified or identifiable natural person, or (2) that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual or household, regardless of the media in which it is maintained.

(I) “Privacy Laws” means (i) all applicable international, federal, state, national, provincial and local laws, rules, regulations, directives and governmental requirements currently in effect and as they become effective relating in any way to the privacy, confidentiality or security of Personal Data, including without limitation, European Data Protection Laws and the CCPA, Cal. Civ. Code § 1798.100 et seq. and its implementing regulations; (ii) all applicable industry standards concerning privacy, confidentiality or information security; and (iii) applicable provisions of Agency’s or Client’s written requirements currently in effect and as they become effective relating in any way to the privacy, confidentiality or security of Personal Data or applicable privacy policies, statements or notices that are provided to Vendor in writing.

(J) “Privacy Shield” means, collectively, the EU-U.S. Privacy Shield framework and the Swiss-U.S. Privacy Shield framework.

(K) “Process” (and its derivatives) means any operation or set of operations performed upon Personal Data, whether or not by automatic means, including, without limitation, creating, collecting, aggregating, procuring, obtaining, accessing, recording, organizing, structuring, storing, adapting, altering, retrieving, consulting, using, disclosing, disseminating, making available, aligning, combining, restricting, erasing and/or destroying the information.

(L) “Sub-Processor” means any entity engaged by Vendor (or further Sub-Processor) to Process Personal Data on behalf and under the authority of Agency or Client.

(M) “Vendor Personnel” means any employees, agents, consultants or contractors of Vendor.

II. Privacy of Personal Data.

(A) The Parties acknowledge and agree as follows:

a. Agency, or Client, as the case may be, is acting as a Data Controller, and has the sole and exclusive authority to determine the purposes and means of the Processing of Personal Data Processed under this DPA, and Vendor is acting solely as a Data Processor on behalf and under the Instructions of Agency or Client. Vendor acknowledges and agrees that between Vendor and Agency, Agency or Client owns all Personal Data.

b. During the time the Personal Data is disclosed to Vendor, neither Agency nor Client will have knowledge or reason to believe that vendor is unable to comply with the provisions of this DPA.

(B) Vendor represents, warrants and covenants as follows:

a. Vendor shall hold in strict confidence any and all Personal Data and shall Process Personal Data only to the extent, and in such manner, as is necessary to provide services for or on behalf of Agency and Client in accordance with this DPA.

b. Vendor shall process Personal Data only on behalf of and in accordance with the Instructions of Agency or Client, unless Vendor is otherwise required by applicable law, in which case Vendor shall inform Agency of that legal requirement before Processing the Personal Data (unless informing Agency is prohibited by law on important grounds of public interest). Vendor shall not (i) sell Personal Data, or (ii) retain, use or disclose Personal Data (a) for any purpose other than for the specific purpose of performing the services specified in the Agreement, or (b) outside of the direct business relationship between the Parties. Vendor shall immediately inform Agency if, in Vendor’s opinion, an Instruction infringes Privacy Law.

c. Vendor shall ensure that any Vendor Personnel is only granted access to Personal Data on a need-to-know basis, is subject to a duly enforceable contractual or statutory privacy, confidentiality and security obligations that are substantially similar to those required by this DPA, and only processes Personal Data in accordance with the Instructions of Agency or Client.

d. Vendor shall immediately inform Agency in writing of any requests from Data Subjects with respect to Personal Data, including

without limitation, any request to exercise rights under Privacy Laws. Vendor shall cooperate with Agency if an individual requests (i) access to his or her Personal Data, (ii) information about the categories of sources from which the Personal Data is collected, or (iii) information about the categories or specific pieces of his or her Personal Data Processed by Vendor on Agency’s behalf. Vendor shall assist Agency in fulfilling Agency’s obligation to respond to Data Subjects’ requests to exercise their rights with respect to Personal Data, including by providing the requested information in a portable and, to the extent technically feasible, readily useable format that allows the individual to transmit the information to another entity without hindrance. Vendor shall respond to such requests only as specifically directed by Agency and in accordance with Agency’s written instructions and this DPA.

e. Vendor shall assist Agency in complying with its obligations under Privacy Laws, including without limitation, Agency’ and Client’s obligations under European Data Protection Laws to implement appropriate data security measures, to carry out a data protection impact assessment, and to consult the competent supervisory authority.

f. Vendor shall maintain internal record(s) of Processing activities, copies of which shall be provided to Agency by Vendor upon Agency’s request.

g. Vendor shall notify Agency immediately in writing of any subpoena or other judicial or administrative order by a government authority or proceeding seeking access to or disclosure of Personal Data. Agency shall have the right to defend such action in lieu of and/or on behalf of Vendor. Agency may, if it so chooses, seek a protective order. Vendor shall reasonably cooperate with Agency in such defense.

(C) Vendor certifies that it understands and will comply with the requirements and restrictions set forth in this DPA.

III. Data Transfers.

Vendor shall not transfer Personal Data outside the EEA without the explicit written consent of Agency. Where Vendor, with the consent of Agency, transfers Personal Data outside the EEA, Vendor shall comply with Privacy Laws and implement a data transfer mechanism in accordance with Privacy Laws to the extent required for such cross-border transfer, such as the Privacy Shield.

IV. Sub-Processing.

Vendor shall not share, transfer, disclose, make available or otherwise provide access to any Personal Data to any third party, or contract any of its rights or obligations concerning Personal Data, unless Agency or Client has authorized Vendor to do so in writing. Where Vendor, with the consent of Agency or Client, provides access to Personal Data to a Sub-Processor, Vendor shall enter into a written agreement with each such Sub-Processor that imposes obligations on the Sub-Processor that are the same as those imposed on Vendor under this DPA and requires the Sub-Processor to provide at least the same level of protection as is required by this DPA. Vendor shall only retain Sub-Processors that are capable of appropriately protecting the privacy, confidentiality and security of the Personal Data. Vendor shall remain fully liable to Agency and Client for its obligations under this DPA, even if such obligations are delegated to a Sub-Processor.

V. Compliance with Applicable Laws.

(A) Vendor shall comply with all applicable Privacy Laws.

(B) In the event a law, legal requirement, enforcement action, investigation, litigation or claim, or any other circumstance, is reasonably likely to adversely affect Vendor’s ability to fulfill its obligations under this DPA, Vendor shall promptly notify Agency in writing and Agency or Client may, in its sole discretion and without penalty of any kind to Agency or Client, suspend the (i) transfer or disclosure of Personal Data to Vendor or (ii) access to Personal Data by Vendor, and terminate any further Processing of Personal Data by Vendor, and terminate the Agreement, if doing so is necessary to comply with Privacy Laws.

(C) Vendor shall enter into any further data processing agreement reasonably requested by Agency or Client for purposes of compliance with Privacy Laws.

VI. Data Security.

(A) Vendor shall develop, implement and maintain a comprehensive written information security program that complies with applicable Privacy Laws as well as the terms and conditions of this PO. Vendor’s information security program shall include reasonable and appropriate administrative, technical, physical, organizational and operational safeguards and other security measures to (i) ensure the security and confidentiality of Personal Data; (ii) protect against any anticipated threats or hazards to the security and integrity of Personal Data; and (iii) protect against any Information Security Incident. These measures shall include, as appropriate and without limitation, pseudonymization, deidentification, aggregation or encryption of the Personal Data; the ability to ensure the ongoing confidentiality, integrity, availability and resilience of Processing systems and services; the ability to restore the availability and access to the Personal Data in a timely manner in the event of a physical or technical incident; and a process for regularly testing, assessing and evaluating the effectiveness of technical and organizational measures for ensuring the security of the Processing.

(B) Vendor shall perform services in compliance with the Payment Card Industry Data Security Standard (“PCI DSS”), and hereby acknowledges its responsibility for the security of any Cardholder Data (as such term is defined in the PCI DSS), which it stores, transmits or processes in connection with this DPA. Vendor shall perform any and all tasks, assessments, reviews, penetration tests, scans and other activities required under the PCI DSS for companies in the same category(s) as Agency and Client (including any compliance guidance issued by the PCI Data Security Council or its subordinate bodies) or otherwise to validate during the term of this PO its compliance with the PCI DSS as it relates to the system elements and portions of the cardholder data environment (as such terms are defined in the PCI DSS) for which Vendor is responsible. Upon Agency’s or Client’s request, Vendor shall deliver to Company copies of all documentation necessary to verify such compliance, including without limitation, any attestation of compliance, report on compliance, self-assessment questionnaire, or testing or assessment results.

(C) Vendor shall exercise the necessary and appropriate supervision over Vendor Personnel to maintain appropriate privacy, confidentiality and security of Personal Data in accordance with this DPA. Vendor shall provide training, as appropriate, regarding the privacy, confidentiality, and information security requirements set forth in this DPA to relevant Vendor Personnel who have access to Personal Data.

(D) Promptly upon the expiration or earlier termination of this DPA, or such earlier time as Agency or Client requests, Vendor shall return to Agency, Client or its designee, or at Agency’s or Client’s request, securely delete, destroy or render unreadable or undecipherable if return is not reasonably feasible or desirable to Agency or Client (which decision shall be based solely on Agency’s or Client’s written statement), each and every original and copy in every media of all Personal Data in Vendor’s, its affiliates’ or any Sub-Processor’ possession, custody or control. Promptly following any return or alternate action taken to comply with this paragraph, Vendor shall provide to Agency or Client a completed Officer’s Certificate certifying that such return or alternate action occurred. In the event and during the period that Vendor is unable to perform such delivery, deletion or destruction of certain Personal Data for reasons permitted under applicable law, Vendor warrants that it shall (i) promptly inform Agency or Client of the reason(s) for its refusal of the deletion request, (ii) ensure the privacy, confidentiality and security of the Personal Data in accordance with this DPA, and (iii) delete the Personal Data promptly after the reason(s) for Vendor’s refusal has expired, and that Vendor shall not use or disclose any Personal Data after termination of this DPA.

VII. Data Breach Notification.

(A) Vendor shall immediately inform Agency in writing of any Information Security Incident of which Vendor becomes aware, but in no case longer than twenty-four (24) hours after it becomes aware of the Information Security Incident. The notification to Agency shall include all available information regarding such Information Security Incident, including information on: (i) the nature of the Information Security Incident including where possible, the categories and approximate number of affected Data Subjects and the categories and approximate number of affected Personal Data records; (ii) the likely consequences of the Information Security Incident; and (iii) the measures taken or proposed to be taken to address the Information Security Incident, including, where appropriate, measures to mitigate its possible adverse effects.

(B) Vendor shall promptly investigate such Information Security Incident, take all necessary and advisable corrective actions, and shall cooperate fully with Agency and Client in all reasonable and lawful efforts to prevent, mitigate or rectify such Breach. Vendor shall provide Agency and Client with such assurances as Agency or Client shall request that such Information Security Incident is not likely to recur. Vendor shall provide such assistance as required to enable Agency and Client to satisfy their respective obligation(s) under Privacy Laws. The content of any filings, communications, notices, press releases or reports related to any Information Security Incident must be approved by Agency prior to any publication or communication thereof.

(C) Agency or Client shall have the right at any time after learning of an Information Security Incident to engage and involve external forensic firms in the investigation of the Information Security Incident (which will include a right to investigate Vendor’s systems), and Vendor shall comply with all reasonable requests of such external forensic firm. Vendor shall use commercially reasonable efforts to preserve all applicable evidence relating to the Information Security Incident until the forensic investigation is completed or confirmed to Vendor that it waives its right to conduct such an investigation.

(D) In the event of an Information Security Incident involving Personal Data in Vendor’s possession, custody or control or for which Vendor is otherwise responsible, Vendor shall reimburse Agency or Client, as the case may be, on demand for all commercially reasonable Notification Related Costs incurred by Agency or Client, as the case may be arising out of or in connection with any such Information Security Incident.

VIII. Audit.

(A) Vendor shall make available to Agency or Client all information necessary to demonstrate compliance with the obligations set forth in this DPA and allow for and contribute to audits, including inspections, conducted by Agency or Client or another auditor mandated by Agency or Client.

(B) Agency or Client shall have the right to monitor Vendor’s compliance with this DPA. During normal business hours, and reasonable prior notice, Agency or Client and/or its authorized representatives may inspect Vendor’s facilities and equipment, and any information or materials in Vendor’s possession, custody or control, relating in any way to Vendor’s obligations under the Agreeement. An inspection performed pursuant to this DPA shall not unreasonably interfere with the normal conduct of Vendor’s business. Vendor shall cooperate fully with any such inspection initiated by Agency or Client.

(C) Vendor shall notify Agency in writing in the event of a material change to Vendor’s internal security plans, controls or measures.

IX. Liability.

Vendor agrees to indemnify and hold Agency and Client harmless from and against any losses that it may incur or that arise out of or in connection with a third party claim relating to (i) any violation of this DPA and/or Privacy Laws, (ii) Vendor’s negligence, gross negligence, bad faith, fraudulent acts or omissions, or intentional or willful misconduct, (iii) Vendor’s use of any Sub-Processor providing services in connection with or relating to Vendor’s performance under this DPA; and (iv) any Information Security Incident involving Personal Data in Vendor’s possession, custody or control, or for which Vendor is otherwise responsible. For the purposes of this DPA, “Losses” means all judgments, settlements, awards, damages, losses, charges, liabilities, penalties, interest claims (including taxes and all related interest and penalties incurred directly with respect thereto), and all related reasonable costs, expenses and other charges (including all reasonable attorneys’ fees and reasonable internal and external costs of investigations, litigation, hearings, proceedings, document and data productions and discovery, settlement, judgment, award, interest and penalties). In no event shall Vendor’s liability be excluded or limited for a violation of its obligation under this DPA.

X. Governing Law. This DPA shall be governed by the laws of the Netherlands.

XI. Miscellaneous.

(A) Vendor’s obligations under this DPA shall survive the termination of this DPA and/or the Agreement and the completion of all services subject thereto.

(B) If any provision of this DPA is held invalid or unenforceable, the remaining provisions shall remain in effect.

(C) This DPA is binding upon successors and assigns of the parties.

(D) A waiver by either Party of any term or condition of this DPA in one or more instances shall not constitute a permanent waiver of the term or condition or any other term or condition of this DPA or a general waiver.

(E) As required or upon request, Vendor agrees that Agency or Client may provide a summary or copy of this DPA to any government agency.

Confidential - Not for Public Consumption or Distribution