Arqdia Data Processing Agreement

This Data Processing Agreement (“DPA”) forms part of and is governed by the Master Service Agreement and any other agreement (“Agreement”) executed by and between Arqdia Intelligence Ltd. (“Arqdia”), and the Customer. Arqdia and Customer shall each be referred to as “party” and collectively as “parties”.

This DPA is effective as of the Effective Date of the Agreement, unless otherwise expressly agreed by the parties in writing. The term of this DPA will continue for so long as the Agreement remains in effect or, if later, until Arqdia ceases all Processing of Customer Data on behalf of Customer.

All capitalized terms not defined herein shall have the meaning set forth in the Agreement.

WHEREAS, Arqdia provides Customer with the Services as defined in the Agreement and the applicable Order Form; and

WHEREAS, the Services require Arqdia to Process Customer Data, which may include Personal Data (as such terms are defined below), on Customer's behalf, subject to the terms and conditions of this DPA and applicable Data Protection Laws.

1. DEFINITIONS

1.1.“Adequate Country” is a country that received an adequacy decision from the European Commission or other applicable data protection authority.

1.2.The terms “Business”, “Business Purpose”, “Consumer”, “Controller”, “Data Subject”, “Personal Data”, “Personal Data Breach”, “Personal Information”, “Processing” (and “Process”), “Processor”, “Holder”, “Service Provider”, “Sale”, “Sell” and “Share”, “Special Categories of Personal Data”, “Sensitive Data” and “Supervisory Authority”, shall all have the same meanings as ascribed to them under the applicable Data Protection Laws. Further, under this DPA: “Data Subject” shall also mean and refer to a “Consumer”, “Personal Data” shall also mean and refer to “Personal Information” and “Special Categories of Data” or “Highly Sensitive Data” shall also mean and refer to “Sensitive Data”.

1.3.“Customer Data” means Customer Data (as defined in the Agreement) containing Personal Data (or the equivalent term) Processed by Arqdia in the course of providing the Services, all as further described in Annex I attached hereto.

1.4.“Data Protection Law” means any and all applicable privacy and data protection laws and regulations (including, where applicable, EU Data Protection Law, UK Data Protection Laws, Swiss Data Protection Laws, Israeli Law and the U.S. Data Protection Laws) as may be amended or superseded from time to time.

1.5.“Deidentified Data” means information that cannot reasonably identify, relate to, describe, be capable of being associated with, be linked directly or indirectly with, or be reasonably be used to infer information about an identifiable natural person, all as defined under applicable US Data Protection Laws.

1.6.“Data Privacy Framework” or “DPF” means the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. Data Privacy Framework and the Swiss-U.S. Data Privacy Framework self-certification programs (as applicable) operated by the U.S. Department of Commerce; as may be amended, superseded, or replaced.

1.7.“DPF Principles” means the Principles and Supplemental Principles available at: https://www.dataprivacyframework.gov/program-articles/Participation-Requirements-Data-Privacy-Framework-(DPF)-Principles; as may be amended, superseded or replaced.

1.8.“EEA” means the European Economic Area.

1.9.“European Data Protection Law” means, collectively, the laws and regulations of the European Union, the EEA, their member states, and the United Kingdom, applicable to the Processing of Personal Data, including (where applicable): (i) “EU Data Protection Laws”- EU General Data Protection Regulation (Regulation 2016/679) (“EU GDPR”); Regulation 2018/1725; and the e-Privacy Directive (Directive 2002/58/EC), as amended (e-Privacy Law); (ii) “UK Data Protection Laws” - the Data Protection Act 2018 (DPA 2018), as amended, and EU GDPR as incorporated into UK law as amended (“UK GDPR” and collectively with the EU GDPR shall be referred to herein as the “GDPR”); (iii) “Swiss Data Protection Laws” or “FADP” - the Swiss Federal Data Protection Act (dated June 19, 1992, as of March 1, 2019) (“FDPA”) and the Ordinance on the Federal Act on Data Protection (“FODP”); (iv) any national data protection laws made under, pursuant to, replacing or succeeding the EU GDPR or the e-Privacy Law; (v) any amendment or legislation replacing or updating any of the foregoing; and (vi) any judicial or administrative interpretation of any of the above, including any binding judicial or administrative interpretation of any of the above, or approved certification mechanisms issued by any relevant Supervisory Authority.

1.10.“Instructions” means the written, documented instructions provided by the Customer to Arqdia directing Arqdia to perform a specific or general action with regard to Customer Data.

1.11.“Israeli Data Protection Laws” means, collectedly, the: (i) Israeli Protection of Privacy Law, 5741-1981 (as amended under Amendment 13); (ii) the regulations promulgated pursuant thereto, including the Israeli Protection of Privacy (Data Security) Regulations, 5777-2017 and the Israeli Protection of Privacy (Transfer of Data to Databases Abroad) Regulations, 5761-2001; (iii) any amendments or legislation replacing or updating any of the foregoing; and (iv) any judicial or administrative interpretation of any of the above, including any binding guidance, guidelines, codes of practice, approved codes of conduct or certification mechanisms approved by the Israeli Privacy Protection Authority.

1.12.“Security Incident” means any accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Data. Any Personal Data Breach will comprise a Security Incident.

1.13.“Standard Contractual Clauses” or “SCCs” means: (i) the standard contractual clauses for the transfer of Personal Data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council adopted by the European Commission Decision 2021/914 of 4 June 2021, which may be found at: https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32021D0914&from=EN and incorporated herein by reference (“EU SCC”); (ii) the UK “International Data Transfer Addendum to the European Commission Standard Contractual Clauses” available at: https://ico.org.uk/media/for-organisations/documents/4019539/international-data-transfer-addendum.pdf and incorporated herein by reference (“UK SCC”); or (iii) the applicable standard data protection clauses issued, approved or recognized by the Swiss Federal Data Protection and Information Commissioner (“Swiss SCC”).

1.14.“US Data Protection Laws” means any and all applicable federal and state privacy laws and regulations applicable to Arqdia's Processing of Customer Data under this DPA, and any implementing regulations and amendments thereto, including without limitation: (i) the California Consumer Privacy Act (Cal. Civ. Code §§ 1798.100 - 1798.199), as amended by the California Privacy Rights Act and together with all regulations promulgated thereunder from time to time (“CCPA”); (ii) the Colorado Privacy Act, C.R.S. § 6-1-1301 et seq. (“CPA”); (iii) the Connecticut Data Privacy Act (“CTDPA”); (iv) the Florida Digital Bill of Rights (“FDBR”); (v) the Montana Consumer Data Privacy Act 68th Legislature 2023, S.B. 0384 (“MTCDPA”); (vi) the Oregon Consumer Data Privacy Act ORS 646A.570-646A.589 (“OCDPA”); (vii) the Texas Data Privacy and Security Act, Tex. Bus. & Com. Code Ann. § 541.001 et seq (“TDPSA”); (viii) the Utah Consumer Privacy Act, Utah Code Ann. § 13-61-101 et seq (“UCPA”); (ix) the Washington “My Health My Data” Act, Wash. Rev. Code § 19.373.005 et seq., and Nev. Rev. Stat. § 603A, as amended by Nevada S.B. 370 (together, the “Washington and Nevada Consumer Health Data Laws”); and (x) the Virginia Consumer Data Protection Act, Va. Code Ann. § 59.1-575 et seq. (SB 1392). All as amended or superseded from time to time and including any implementing regulations and amendments thereto.

2. ROLES AND DETAILS OF PROCESSING

2.1.The parties agree and acknowledge that, in connection with the performance of their respective obligations under the Agreement and with respect to the Processing of Customer Data, Arqdia acts as a Processor or Sub-processor, as applicable, and Customer acts as a Controller or Processor, as applicable. Notwithstanding the above, Arqdia is the owner and Controller of the Usage Data (as defined in the Agreement) and other account information, such as contact information, transactions and other data which is used to manage the customer relationship, provide support, repair bugs, facilitate security, optimize the user experience, provide maintenance and carry out core business functions such as accounting, billing, and filing taxes.

2.2.The Customer shall be exclusively responsible to ensure its Instructions are compliant with applicable Data Protection Laws and enable a lawful Processing of Customer Data, including by obtaining any required consent and providing any required disclosures under applicable Data Protection Laws.

2.3.The subject matter and duration of the Processing carried out by Arqdia on behalf of Customer, the nature and purpose of the Processing, and the types of Personal Data and categories of Data Subjects are described in Annex I attached hereto.

2.4.If any Sensitive Data or Special Categories of Personal Data or Highly Sensitive Data is processed (as those terms are defined under Data Protection Laws), including, any information that constitutes “consumer health data” under the CTDPA or the Washington and Nevada Consumer Health Data Laws or any information that constitutes “protected health information” under the Health Insurance Portability and Accountability Act of 1996, 5 U.S.C. § 553 et seq., together with any amending legislation and any regulations promulgated thereunder or any Personal Data that is deemed by US regulatory authorities as meriting sensitive treatment under US Data Protection Laws or U.S. state or federal consumer protection laws such as financial information, demographic information, credit scores, etc., it is Customer’s responsibility to inform Arqdia of such processing, and ensure additional contractual obligations are met, if needed and applicable. For avoidance of doubt, Arqdia does not monitor, and review Customer Data processed according to this DPA, and may not be aware of any sensitivity within Customer Data.

2.5.The Customer acknowledges and agrees that, as part of the Processing, the Customer Data will be processed using Artificial Intelligence features and technologies, as described in the Agreement.

3. PROCESSING OF PERSONAL DATA

3.1.Arqdia represents and warrants that it shall Process Customer Data on behalf of Customer solely for the purpose of providing the Services and otherwise in accordance with Customer's documented Instructions and this DPA. Notwithstanding the foregoing, if Arqdia is required under applicable law, including Data Protection Laws, to Process Customer Data other than as instructed by Customer, Arqdia will, unless prohibited by applicable law, inform Customer of that legal requirement before such Processing.

3.2.Arqdia shall inform Customer without undue delay if, in Arqdia's reasonable opinion, any of Customer's Instructions infringes applicable law, and Arqdia shall have the right to immediately cease and suspend any such Processing activity related to the infringing Instruction.

3.3.Arqdia certifies that it understands the restrictions and requirements applicable to it under Data Protection Laws and shall not: (i) Sell or Share Customer Data; (ii) retain, use, or disclose Customer Data for any purpose other than the Business Purpose specified in the Agreement and this DPA, including providing the Services; or (iii) combine Customer Data with personal data that Arqdia receives from, or on behalf of, another customer.

3.4.Arqdia shall comply with the requirements set forth under applicable Data Protection Laws with respect to the Processing of Deidentified Data.

3.5.Arqdia shall provide reasonable cooperation and assistance to Customer in ensuring compliance with Customer's obligations to carry out data protection impact assessments and prior consultations with Supervisory Authorities or other competent data protection authorities, to the extent required under applicable Data Protection Laws, provided that Arqdia shall only be required to assist with information reasonably available to Arqdia and to the extent Customer does not otherwise have reasonable access to such information.

3.6.Arqdia shall ensure: (i) the reliability of its personnel and any other persons acting under its authority who may access or otherwise Process Customer Data; and (ii) that persons authorized to Process Customer Data are subject to confidentiality obligations or appropriate statutory obligations of confidentiality.

4. DATA SUBJECTS RIGHTS AND REQUESTS

4.1.It is agreed that where Arqdia receives a data subject request or a request from a regulator or authority in respect to Customer Data, where applicable, Arqdia will notify the Customer of such request promptly and direct the Data Subject or the applicable authority to the Customer in order to enable the Customer to respond directly to the Data Subject's or the applicable authority's request, unless otherwise required under applicable laws or prohibited.

4.2.Arqdia shall reasonably cooperate with and assist Customer in responding to such requests, provided that Customer cannot reasonably fulfill such obligations independently using the documentation, the Services, or any other self-service functionality made available by Arqdia.

5. SUB-PROCESSING

5.1.Customer acknowledges that Arqdia may transfer Customer Data to and otherwise interact with third party data Processors (“Sub-Processor”). The Customer hereby authorizes Arqdia to engage and appoint such Sub-Processors as listed in Annex III, to Process Customer Data, as well as permits each Sub-Processor to appoint a Sub-Processor on its behalf. Arqdia may continue to use those Sub-Processors already engaged by it, as listed in Annex III, or to engage an additional or replace an existing Sub-Processors to Process Customer Data, subject to the provision of a thirty (30) days prior notice of its intention to do so to the Customer (via email correspondence). In case the Customer has not objected to the adding or replacing of a Sub-Processor within such notice period, such Sub-Processor shall be deemed approved by the Customer. In the event the Customer objects to the adding or replacing of a Sub-Processor, within such notice period, Arqdia may, under Arqdia sole discretion, suggest the engagement of a different Sub-Processor for the same course of services, or otherwise terminate the Agreement where the Services cannot be reasonably provided under such circumstances, without liability to Customer.

5.2.Arqdia may update its list of Sub-processors from time to time in accordance with this DPA and shall provide Customer with notice of any such update.

5.3.Arqdia shall, where it engages any Sub-Processor, impose, through a legally binding contract between Arqdia and the Sub-Processor, data protection obligations that are no less onerous than, and provide at least the same level of protection as, those set out in this DPA. Arqdia shall ensure that such contract will require the Sub-Processor to provide sufficient guarantees to implement appropriate technical and organizational measures in such a manner that the Processing will meet the requirements of Data Protection Laws.

5.4.Arqdia shall remain responsible to Customer for the performance of the relevant Sub-Processor's obligations to the extent required under applicable Data Protection Laws and the Agreement.

6. TECHNICAL AND ORGANIZATIONAL MEASURES

6.1.Taking into account the state of the art, the costs of implementation and the nature, scope, context, and purposes of Processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, and without prejudice to any other security standards agreed upon by the parties, Arqdia hereby confirms that it has implemented and will maintain appropriate physical, technical and organizational measures to protect the Customer Data as required under Data Protection Laws to ensure lawful Processing of Customer Data and safeguard Customer Data from unauthorized, unlawful or accidental processing, access, disclosure, loss, alteration or destruction.

6.2.The parties acknowledge that security requirements are constantly changing, and that effective security requires the frequent evaluation and regular improvement of outdated security measures.

6.3.The technical and organizational measures implemented and maintained by Arqdia are further described in Annex II.

7. SECURITY INCIDENT

7.1.Arqdia will notify the Customer without undue delay upon becoming aware of any Security Incident involving the Customer Data and will take necessary steps to remediate, minimize any effects of and investigate any Security Incident and to identify its cause. Upon Customer's request, Arqdia will reasonably co-operate with the Customer and provide the Customer with such assistance and information as it may reasonably require in connection with the containment, investigation, or mitigation of the Security Incident.

7.2.Arqdia will provide written updates to Customer regarding material developments related to the Security Incident as reasonably available. Arqdia's notification of or response to a Security Incident shall not be construed as an acknowledgment of fault or liability by Arqdia.

8. AUDIT RIGHTS

8.1.Arqdia shall maintain accurate written records of any and all the Processing activities carried out under this DPA and shall make such records available to the Customer upon 30-day prior written request, and not more than once per twelve (12) months during the Term of the Agreement. Such records provided shall be considered Arqdia's Confidential Information and shall be subject to confidentiality obligations.

8.2.In the event the records and documentation provided subject to Section 8.1 above are reasonably determined as not sufficient for the purpose of demonstrating compliance, Customer may audit Arqdia compliance with this DPA and Data Protection Laws by requesting a certificate issued for security verification reflecting the outcome of an audit conducted by a third party auditor (e.g., ISO27001 certificate) or a comparable certification or other security certification of an audit conducted by a third-party auditor, within twelve (12) months as of the date of Customer's request.

8.3.Alternatively, in the event the records and documentation provided subject to Section 8.1 and 8.2 above are not sufficient for the purpose of demonstrating compliance, Arqdia shall make available, solely upon prior reasonable written notice and no more than once per calendar year, to a reputable auditor nominated by the Customer, information necessary to reasonably demonstrate compliance with this DPA and Data Protection Laws, and shall allow for audits, including inspections, by such reputable auditor solely in relation to the Processing of the Customer Data (“Audit”) in accordance with the terms and conditions hereunder. The auditor shall be subject to standard confidentiality obligations (including towards third parties). Arqdia may object to an auditor appointed by the Customer in the event Arqdia reasonably believes the auditor is not suitably qualified or is a competitor of Arqdia. Customer shall bear all expenses related to the Audit and shall (and ensure that each of its auditors shall) over the course of such Audit, avoid causing any damage, injury, or disruption to Arqdia’s premises, equipment, personnel and business while its personnel are on those premises in the course of such Audit.

8.4.Nothing in this DPA will require Arqdia to either disclose to Customer or its third-party auditor, or to allow Customer or its third-party auditor to access: (i) any data of any other Arqdia's customer; (ii) Arqdia's internal accounting or financial information; (iii) any trade secret of Arqdia or its Affiliates; (iv) any information that, in Arqdia's reasonable opinion, could compromise the security of any Arqdia's systems or cause any breach of its obligations under applicable law or its security or privacy obligations to any third party; or (v) any information that Customer or its third-party auditor seeks to access for any reason other than the good faith fulfillment of Customer's obligations under the Data Protection Laws.

9. CROSS BORDER PERSONAL DATA TRANSFERS

9.1.Arqdia shall ensure any recipients of Customer Data, including recipients of onward transfers are recognized as Adequate Country or certified under the DPF. Further, where European Data Protection Laws apply Arqdia will not transfer Customer Data originating from the EEA, UK or Switzerland, unless it takes all such measures as are necessary to ensure the transfer is in compliance with European Data Protection Laws. Such measures may include (without limitation): (i) transferring such Customer Data to a recipient that is covered by a suitable framework or other legally adequate transfer mechanism recognized by the relevant authorities or courts as providing an adequate level of protection for Personal Data, including to an Adequate Country or data privacy and transfer frameworks; (ii) to a recipient that has achieved binding corporate rules authorization in accordance with applicable Data Protection Law; or (iii) to a recipient that has executed the Standard Contractual Clauses.

9.2.When Customer and Arqdia rely on the SCC to facilitate a transfer to a third country the following shall apply:

1. For Transfer of Customer Data from the EEA the EU SCC shall apply and completed as follows: (1) Module II (Controller to Processors) will apply; (2) In Clause 7 the optional docking clause will not apply; (3) In Clause 9, option 2 (general written authorization) shall apply for the Sub-Processors listed under Annex III and the method for appointing Sub-Processor shall be as set forth in the Sub-Processing Section of the DPA; (4) In Clause 11, the optional language will not apply, and Data Subjects shall not be able to lodge a complaint with an independent dispute resolution body; (5) In Clause 17, option 1 shall apply, and the EU SCC shall be governed by the law of the Republic of Ireland; (6) In Clause 18(b) the parties choose the competent courts of the Republic of Ireland, as their choice of forum and jurisdiction; (7) Annex I(A) of the EU SCC is completed as follows: Customer is the Data Exporter, Arqdia is the Data Importer, the parties' contact details Agreement Effective Date; Annex I(B) of the EU SCC is completed as set out in Annex I of this DPA; Annex I(C) of the EU SCC shall identify the competent supervisory authority/ies as the supervisory authority Republic of Ireland; (8) Annex II of the EU SCC is deemed completed with the information set out in Annex II of this DPA; (9) Annex III of the EU SCC shall be completed with the list of Sub-Processors set out in Annex III of this DPA.
2. For transfer of Customer Data from the UK, the UK SCC shall apply and completed as follows: (1) Table 1 shall be completed as set forth in section (a)(7) above; (2) Table 2 shall be completed as set forth in Section (a)(1) - (a)(4) above; (3) Tables 3 shall be completed as follows: Annex 1A shall be completed with relevant information as set out in Section (a)(7) above; Annex 1B shall be completed with relevant information as set out in Annex I of this DPA; Annex II shall be completed with relevant information as set out in Annex II of this DPA; Annex III shall be completed with the list of sub-processors set out in Annex III of this DPA; (4) Table 4 shall be completed with the “neither party” option; and (5) Any conflict between the terms of the EU SCC and the UK SCC will be resolved in accordance with Section 10 and Section 11 of the UK SCC.
3. For transfer of Customer Data from Switzerland, the Swiss SCC shall apply in with following modifications (i) references to “Regulation (EU) 2016/679” will be interpreted as references to the Swiss DPA; (ii) references to “EU”, “Union” and “Member State law” will be interpreted as references to Swiss law; and (iii) references to the “competent supervisory authority” and “competent courts” will be replaced with the “the Swiss Federal Data Protection and Information Commissioner” and the “relevant courts in Switzerland”.

10. TERM, TERMINATION AND CONFLICT

10.1.This DPA shall be effective as of the Effective Date and shall remain in force until the Agreement terminates or as long as Arqdia Processes Customer Data.

10.2.Arqdia shall be entitled to terminate this DPA or cease the Processing of Customer Data in the event that Processing of Customer Data under the Customer’s instructions or this DPA infringe applicable legal requirements, provided Customer did not cure such infringement within ten (10) days from receiving applicable notice from Arqdia. Alternately, Arqdia may, in its sole discretion, suspend the Processing of the Customer Data until such infringement is cured without terminating the DPA.

10.3.Following the termination or expiration of this DPA, Arqdia shall, upon Customer’s written request, delete all Customer Data Processed on behalf of the Customer and certify to the Customer that it has done so, or, return all Customer Data to the Customer and delete existing copies, unless applicable law or regulatory requirements requires that Arqdia continue to store Customer Data. Until the Customer Data is deleted or returned, the parties shall continue to ensure compliance with this DPA. Customer’s choice shall be provided in writing to Arqdia, following effect of termination.

10.4.In the event of a conflict between the terms and conditions of this DPA and the Agreement, this DPA shall prevail. For the avoidance of doubt, in the event Standard Contractual Clauses have been executed between the parties, the terms of the Standard Contractual Clauses shall prevail over those of this DPA. Except as set forth herein, all of the terms and conditions of the Agreement shall remain in full force and effect.

Annex I

Details of Processing

This Annex I sets out certain details regarding the Processing of Personal Data as required under applicable Data Protection Laws.

Categories of Data Subjects

Customer’s guests, prospective guests and other individuals whose Personal Data is included in Customer Data submitted to or processed through the Services.

Categories of Personal Data

Full name, email address, telephone number, message content, reservation or booking identifiers, review content, reviewer details, host or property-related correspondence, account information, and any other Personal Data submitted by or on behalf of Customer through the Services.

Special Categories of Personal Data

None. Unless specifically notified by Customer regarding data concerning health or otherwise data that could be defined as Special Categories of Personal Data and as approved by Arqdia, including without limitation, information that the guest can provide through the communication with the Customer.

Nature of the Data Processing Activities

Collection, storage, organization, communication, transfer, host and other types of Processing for the purpose of providing the Services as set out in the Agreement.

Purpose(s) of Processing Activities

To provide the Services.

Retention Period

For as long as necessary to provide the Services and perform Arqdia's obligations under the Agreement, unless a longer retention period is required by applicable law or agreed by the parties in writing.

Process Frequency

Continuous basis.

Annex II

Technical and Organizational Measures

1. Information security program. A written information security program is implemented, maintained, and complied with. As part of this program, Arqdia will: (i) implement an audit program to test, and where necessary remediate, identified gaps in security controls at least annually or whenever there is a material change in business practices that may reasonably affect the security or integrity of records containing Agreement Personal Data; (ii) conduct, in accordance with ISO27001 or similar standards, an annual risk assessment evaluating the threats and vulnerabilities associated with its systems; and (iii) produce (pursuant to the results of (i) and (ii)) a documented risk assessment and, where appropriate, risk remediation plan.
2. Security official. A designated management-level security official is responsible for the development, implementation, and ongoing maintenance of the information security program. The appointed official has appropriate and recognized information security credentials and qualifications.
3. Access control. Access rights are assigned according to the principle that employees and third parties are only granted the level of access they need to perform their activities (need-to-know principle). Access rights are granted according to defined (role-based) permissions. The access rights granted are reviewed regularly. Rights that are no longer required are withdrawn immediately.
4. Physical access control. Secure areas are defined on the basis of information security and data protection requirements and protected against unauthorized access by appropriate physical safeguards, defined based on the protection needs of the information located or accessed within them.
5. Incident response plan. Policies and procedures are implemented and maintained to detect, respond to, and otherwise address incidents, including designated points of contact in the event of an incident, as well as procedures to: (i) monitor and detect actual and attempted attacks on, or intrusions into, processing systems; (ii) identify and respond to suspected or known incidents; and (iii) promptly mitigate the harmful effects of any incident, without prejudice to any measures or actions necessary to determine the seriousness of the breach.
6. System testing and maintenance. Arqdia tests and maintains systems designed to protect data, including, without limitation: (i) installing critical security patches for operating systems and applications within thirty (30) days of publication, and other patches and updates within three (3) months; (ii) installing the latest recommended versions of operating systems, software, and firmware for all system components; and (iii) ensuring that up-to-date system security agent software, including malware protection, is configured to receive automatically updated patches and virus definitions at least daily.
7. Audit logging. Hardware, software, or procedural mechanisms are implemented and maintained to record and examine activity in processing systems that contain or use electronic information, including appropriate logs and reports concerning the security requirements set forth in this Schedule.
8. Security awareness and privacy training. An ongoing security and privacy awareness and training program is maintained for all employees, including management, employees, contractors, and other agents. This program includes training on how to implement and comply with the information security program and sets out disciplinary measures for violations of the security program. Security and privacy awareness training is conducted at least annually.

Annex III

List of Sub-Processors