TERMS AND CONDITIONS FOR THE PROVISION OF THE Esadax HOSTING SERVICE AND DOMAINS

Esadax. Terms and conditions for provision of the Esadax Hosting Service

23. Appointment of the Data Processor

The Customer, for the Services covered by this Contract, hereby appoints Esadax as Data Processor and/or Sub-Processor for the processing of third-party data if the Customer acts as Data Processor with respect to such data (in this case, the Customer warrants that it has been appointed by the Data Controller as Data Processor pursuant to Article 28 of EU Regulation 2016/679), with the detailed description of the duties and obligations to which it shall be bound by virtue of such role as follows:

This appointment as Data Processor or Sub-Data Processor and the related clauses have a duration equal to that of the Contract signed between the Customer and Esadax in relation to the chosen Service.

The appointment and this document shall automatically cease to have effect in the event of termination, withdrawal, or loss of effectiveness of the Contract, except when time is needed for the Customer to retrieve personal data as contractually agreed between the parties. Likewise, in the event of tacit Contract renewal, the appointment as Personal Data Processor or Sub-Data Processor shall be deemed automatically renewed for a term equal to the contract duration.

I. Data Processed by Esadax in the Provision of the Services Covered by the Contract

The Services provided by Esadax, in accordance with their Technical Specifications, allow the Customer to process the data in accordance with the timescales and procedures set forth and independently managed by them, without prejudice to the applicable regulations. The scope of Esadax's appointment relates solely to the processing of personal data entered and/or transmitted independently by the Customer through the chosen Service and/or within the scope thereof, and in any event in compliance with the purposes aimed at its correct delivery by Esadax and in accordance with the provisions of the applicable regulations in force at any particular time.

It is understood that, in the provision of the Services, pursuant to Legislative Decree 70/2003, Esadax is neither responsible for the information stored at the Customer's request, nor obligated to monitor the information it transmits or stores, nor does it have an obligation to actively seek facts or circumstances that indicate the presence of illicit activities.

II. Obligations and Rights

As a result of this appointment, Esadax is authorized solely to process the personal data to the extent necessary for performing the activities assigned to it. Esadax is entitled to undertake all activities necessary for ensuring fulfillment of the current relevant provisions as well as the task of organizing, managing, and supervising all processing operations concerning personal data communicated to it by the Customer for the purposes of performing the activities covered under the chosen Service.

In compliance with the provisions of Regulation (EU) 2016/679 and the regulations concerning the processing of personal data, it is hereby specified that Esadax has the following obligations:

• a) To process the personal data entered and/or transmitted within the scope of execution of the Service covered by the Contract, with the technical and security characteristics established pursuant to the provisions thereof, and in accordance with the Manuals, the Technical Specifications governing them, and the Codes of Conduct to which Esadax has adhered in relation to the chosen Service, which for the purposes hereof must be regarded as documentation containing the instructions for the processing of data accepted by the Customer. In the event that the Customer expresses particular needs that require different instructions from the ones described in the aforementioned documentation, they must demonstrate such need to Esadax and describe the measures that need to be guaranteed, which will be evaluated and, providing their implementation is feasible, quoted under a specific offer.

• b) To ensure that the persons authorized to process the personal data have pledged confidentiality or have an adequate duty of confidentiality. These parties authorized for data processing, in relation to the performance of the aforementioned activities, shall be specifically assigned such data processing by Esadax, which shall provide them with the necessary instructions and acquaint them with the agreed and prescribed methods as well as with Regulation (EU) 2016/679.

• c) To adopt all the measures required pursuant to Article 32 of Regulation (EU) 2016/679; in particular, with regard to the provision of the chosen Service, Esadax shall implement the measures indicated in the Contract, in the Technical Specifications, in the Manuals related to the Service itself and in the Codes of Conduct to which it has adhered in relation to the chosen Service, as well as the procedures it has adopted according to the ISO 27001 standard.

• d) To assist the Customer - taking into account the nature of the processing - (i) with appropriate technical and organizational measures, as far as possible, in order to respond to requests received for the exercising of the Data Subjects’ rights; (ii) so as to ensure compliance with the obligations set out in Articles 32 to 36 of Regulation (EU) 2016/679, also taking into account the information available to Esadax.

• e) To cancel or return all the personal data to the Customer, at their request, once provision of the services relating to their processing has come to an end, and to delete the existing copies.

• f) To make available to the Customer all the information necessary for demonstrating compliance with the obligations relating to the appointment set forth in this document, so as to enable and facilitate the revision and verification activities. These activities may be carried out after a 20 (twenty) days' notice, at a maximum of once a year and, in addition, in the event of data breaches on the Customer's personal data, and in any case subject to prior agreement on the times and methods of said checks and provided that said checks do not involve the analysis of third-party data and do not conflict with the confidentiality obligations assumed by Esadax and with its policies. Costs of these verifications shall be borne by the Customer.

Accordingly, Esadax shall process the data in compliance with the aforementioned instructions, the guidelines in the Manual governing the Service, any relevant attachments, and the provisions of Regulation (EU) 2016/679, and in compliance with the security requirements established for provision of the individual services.

III. Sub-processors

By signing this document, the Customer authorizes Esadax to use its own sub-processors, as well as third-party suppliers and companies belonging to the Esadax Group for provision of services (support, maintenance, provision of additional services, providers of networks and electronic communication services) related to the requested service; the Customer acknowledges and accepts that this may entail the processing of data by said third parties.

In order to appoint a sub-processor, Esadax guarantees, by means of a separate written contract with said sub-processor, that:

• a) The sub-processor shall only access the Customer’s data to the extent required for fulfilling the obligations delegated to them in accordance with the Contract.

• b) The sub-processor shall assume the obligations pursuant to article 28 of Regulation (EU) 2016/679.

• c) Esadax shall remain responsible before the Customer for all the obligations assumed, including those that relate to the activities entrusted to the sub-processor.

In order to provide the Customer with precise control over the aforementioned third parties, in addition to complying with the requirements of the entire category of such third parties, Esadax undertakes to constantly update the list of said third parties as well as the appropriate documentation comprising the obligations assumed by said third parties in relation to the costs arising from the processing of the personal data specified herein, where they process data within the scope of the chosen Service.

Esadax undertakes to inform the Customer, where required, in the event of any changes made to these third parties.

IV. Breaches

In the case of any events that involve a breach of the data processed by Esadax in relation to the provision of the Services, it shall notify the Customer in the manner and within the timescale pursuant to current applicable legislation.