AK DIGITAL LLC PLATFORM-AS-A-SERVICE (PAAS) SCHEDULE DATA PROCESSING AGREEMENT PURSUANT TO ART. 28 GDPR

1. BACKGROUND

1.1 AK Digital LLC provides services to its clients (data controllers) that may involve processing of personal data and engages sub-processors to perform specific services that may include access to or processing of such data.

2. DEFINITIONS

2.1 Data Processing and its correlative terms mean any operation or set of operations performed on personal data, or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination, or otherwise making available, alignment or combination, restriction, erasure, or destruction.

2.2 Personal Data or Personal Information means all data that is processed by the parties in connection with the Services and (i) identifies or can be used to identify, contact, or locate a natural person, (ii) pertains in any way to an identified natural person, or (iii) falls within any definition of "personal data" or "personal information" under any applicable privacy law.

2.3 Data subject refers to the person whose data is processed.

2.4 Data Controller means the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.

2.5 Data Processor means the entity that processes personal data on behalf of the controller.

2.6 Sub-Processor means any third party appointed by or on behalf of the Processor to process personal data.

2.7 Security Incident means a confirmed or reasonably suspected unauthorized or unlawful breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access to personal data.

2.8 GDPR means Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons concerning the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the General Data Protection Regulation).

3. SCOPE OF THIS SCHEDULED DPA

AK Digital LLC renders the Platform Services to the Client and its Users, which requires the collection and processing of Client Data. This Schedule Data Processing Agreement (hereinafter "DPA") specifies the obligations of Client (as data controller) and AK Digital LLC (as data processor) under data protection law resulting from any processing of Client Data, which arises from the provision, operation, and use of the Platform Services in accordance with the Contract.

4. SUBJECT MATTER AND DURATION OF PROCESSING

4.1 AK Digital LLC will process Client Data on behalf of Client, who acts as data controller (Art. 4 no. 7 GDPR) and determines the purposes of the respective processing.

4.2 The subject matter of processing Client Data is the provision and operation of the Platform Services to Client and its Users, as specified in this Schedule DPA and the Contract.

4.3 The scope, type, and purpose of processing Client Data is to (a) provide; (b) operate; and (c) enable Client and its Users to use the Platform Services as set out in the Contract.

4.4 Some processing of Client Data takes place in a member state of the European Union (EU) or another member state to the agreement on the European Economic Area (EEA).

5. CLIENTS' RESPONSIBILITIES AND GUARANTEES

5.1 As data controller (Art. 4 no. 7 GDPR), Client has sole responsibility over the legitimacy of the processing of Client Data.

5.2 Client guarantees AK Digital LLC that it has collected and processed Client Data in a legal, loyal, and transparent manner.

6. TECHNICAL AND ORGANIZATIONAL MEASURES

6.1 AK Digital LLC shall implement all technical and organizational measures required by law to ensure a level of security appropriate to the risk of processing Client Data.

6.2 AK Digital LLC shall document and provide to Client for verification the implementation scheme for the technical and organizational measures, which are set out in Annex 2.

7. RECTIFICATION, RESTRICTION, AND ERASURE OF CLIENT DATA

7.1 To the extent possible within the functionalities of the Platform Services, Client itself shall rectify, erase, or restrict Client Data.

7.2 The Parties have a common understanding that Client shall handle requests of data subjects.

7.3 AK Digital LLC shall support Client within a reasonable extent in the fulfillment of Client's duties vis-à-vis data subjects.

8. AUDITS AND OTHER DUTIES OF AK DIGITAL LLC

8.1 AK Digital LLC shall process the Client Data solely in accordance with the Contract, this Schedule DPA, and the legitimate instructions of the Client.

8.2 AK Digital LLC shall assist the Client to a necessary and reasonable extent in ensuring compliance with statutory obligations.

9. AUDIT RIGHTS

9.1 Client shall be entitled to verify compliance with the obligations under applicable data protection law and this Schedule DPA.

10. SUB-PROCESSORS

10.1 The sub-processors approved by Client upon conclusion of the Contract are set out in Annex 1.

10.4 AK Digital LLC shall remain liable to Client for the performance of the engaged sub-processor's obligations.

11. REPORT OF BREACHES

11.1 AK Digital LLC shall notify Client without undue delay if a security breach leads to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Client Data.

12. CLIENT'S AUTHORITY TO ISSUE INSTRUCTIONS

12.1 Processing of Client Data shall be governed exclusively by this Schedule DPA and instructions that are possible within the functionalities of the Platform Services.

13. DELETION OF CLIENT DATA

13.2 After the end of processing or at any earlier date required by Client, AK Digital LLC shall erase all Client Data unless statutory duties of retention exist.

ANNEX 1 - SUB-PROCESSORS

- Amazon Web Services, Inc. - United States - Hosting the platform
- Coralogix Ltd. - Israel/Singapore - Hosting the platform services log files
- ZOHO CORPORATION B.V - Netherlands - Hosting customer support ticketing system
- Google LLC - United States - Hosting email servers for employees
- Hyverr S.R.O - Czech Republic - 2nd-level customer support
- PurpleTalk Inc - India - 3rd-level customer support

ANNEX 2 - TECHNICAL AND ORGANIZATIONAL MEASURES

AK Digital LLC implements technical and organizational security measures including:
- Equipment Access Control
- Data Media Control
- Storage Control
- User Control
- Data Access Control
- Communication Control
- Input Control
- Transport Control
- Recovery
- Reliability
- Integrity
- Contractual Control
- Availability Control
- Separation