Technology Agreement Addendum

This Technology Agreement Addendum (“Addendum”) hereby forms part of the Technology Agreement (“Agreement”) between: (i) Aetrex, Inc. (“Aetrex”) and Company, and is incorporated by reference into same.

The terms used in this Addendum shall have the meanings set forth in this Addendum. Except as modified below, the terms of the Agreement shall remain in full force and effect. In the event of inconsistencies between the provisions of this Addendum and the Agreement, the provisions of this Addendum shall prevail.

In consideration of the mutual obligations set out herein, the parties hereby agree that the terms and conditions set out below shall be added as an addendum to the Agreement. Except where the context requires otherwise, references in this Addendum to the Agreement are to the Agreement as amended by, and including, this Addendum.

1.Definitions

1.1. In this Addendum, the following terms shall have the meanings set out below and cognate terms shall be construed accordingly:

1.1.1. “Personal Information” means information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular resident of California or a household located in California;

1.1.2. “Deidentified Information” means information that cannot reasonably identify, relate to, describe, be capable of being associated with, or be linked, directly or indirectly to a particular person or household without the use of additional information;

1.1.3. “Process” or “Processing” means any operation or set of operations which is performed on Personal Information or on sets of Personal Information, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction;

1.1.4. “Services” means the services and other activities to be supplied to or carried out by or on behalf of Vendor for Aetrex pursuant to the Agreement;

1.1.5. “Service Provider” means a person that processes Personal Information on behalf of a business and that receives from or on behalf of the business consumer’s Personal Information for a business purpose pursuant to a written contract;

1.2. The word “include” shall be construed to mean include without limitation, and cognate terms shall be construed accordingly.

2.Processing of Personal Information

2.1. Where Aetrex acts as a Service Provider, the disclosure of Personal Information to Aetrex by Company in the course of the delivery of, use of and access to the Services does not, and shall not, constitute a Sale or Sharing as defined in Cal. Civ. Code § 1798.140. Aetrex provides the Services in return for valuable consideration provided by Company through the payment of the fees. Access to and use of the Services is not provided in return for the disclosure of Personal Information.

2.2. Company shall determine the purpose and means of any Processing of Personal Information pursuant to the Agreement and this Addendum.

2.3. Aetrex shall only Process Personal Information, if at all, on behalf of Company for Company’s business purposes pursuant to the terms of the Agreement and this Addendum.

2.4. In addition to Section 2.3, Aetrex shall not retain, use, or disclose Personal Information except:

2.4.1. to retain and employ another Service Provider as a subcontractor, where the subcontractor meets the requirements for a Service Provider under the Cal. Civ. Code § 1798.100 et seq. and its implementing regulations;

2.4.2. for internal use to build or improve the quality of its Services, provided that the use does not include building or modifying household or individual profiles to use in providing services to another business, or correcting or augmenting data acquired from another source;

2.4.3. to detect data security incidents, or protect against fraudulent or illegal activity;

2.4.4. as necessary to comply with applicable laws;

2.4.5. to comply with a civil, criminal, or regulatory inquiry, investigation, subpoena, or summons by federal, state, or local authorities;

2.4.6. to cooperate with law enforcement agencies concerning conduct or activity that Aetrex reasonably and in good faith believes may violate federal, state, or local law; or

2.4.7. to exercise or defend legal claims.

2.5. Aetrex shall not retain, use, or disclose any Personal Information acquired pursuant to the Agreement and this Addendum for any purpose other than to perform Services pursuant to the terms of the Agreement and this Addendum, unless otherwise required by law.

2.6. Aetrex shall comply with applicable obligations under Cal. Civ. Code § 1798.100 et seq., and its implementing regulations.

2.7. Aetrex shall notify Company if it makes a determination that it can no longer meet its obligations under Cal. Civ. Code § 1798.100 et seq.

2.8. Company has the right, upon written notice, including notice provided under Section 2.6, to take reasonable and appropriate steps to stop and remediate unauthorized use of Personal Information.

2.9. Aetrex may not combine the Personal Information acquired pursuant to the Agreement and this Addendum with Personal Information that it receives from, or on behalf of, another customer, or collects from its own interaction with Company except as provided by Cal. Civ. Code § 1798.100 et seq., and its implementing regulations.

3.Processing of Deidentified Information

3.1. Aetrex may Process any Deidentified Information it acquires pursuant to the terms of the Agreement and this Addendum for any lawful purpose, whether or not it relates to the performance of Services pursuant to the terms of the Agreement and this Addendum.

Last Updated: May 1, 2023