4. Particular obligations relating to data sharing. Sapper and its affiliates agree that they shall:

(a) process the Shared Personal Data only for the Agreed Purposes;

(b) not disclose or allow access to the Shared Personal Data to anyone other than Sapper and its affiliates and/or third parties acting for or on behalf of Sapper and its Affiliates;

(c) ensure that it has in place appropriate technical and organizational measures, to protect against unauthorized or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data

5. Assistance. Contractor shall assist Sapper and its affiliates in complying with all applicable requirements of the

Data Protection Legislation. In particular, Contractor shall:

(a) promptly inform Sapper and its affiliates about the receipt of any data subject access request;

(b) provide Sapper and its affiliates with reasonable assistance in complying with any data subject access request;

(c) not disclose or release any Shared Personal Data in response to a data subject access request without first consulting Sapper and its affiliates wherever possible;

(d) assist Sapper and its affiliates, in responding to any request from a data subject and in ensuring compliance with its obligations under the Data Protection Legislation with respect to security, breach notifications, impact assessments and consultations with supervisory authorities or regulators;

(e) notify Sapper and its affiliates without undue delay on becoming aware of any breach of the Data Protection Legislation;

(f) use compatible technology for the processing of Shared Personal Data to ensure that there is no lack of accuracy resulting from personal data transfers;

(g) maintain complete and accurate records and information to demonstrate its compliance with this Exhibit and allow for audits by Sapper and its affiliates or Sapper’s designated auditor; and

(h) provide Sapper and its affiliates with contact details of at least one employee as point of contact and responsible manager for all issues arising out of the Data Protection Legislation, including the raining of relevant staff, the procedures to be followed in the event of a data security breach, and the regular review of compliance with the Data Protection Legislation.

6. Indemnity. Contractor will indemnify, hold harmless and, at Sapper’s request, defend Sapper and Sapper’s affiliates, directors, officers, employees, agents and independent partners from and against all claims, liabilities, damages, losses and expenses, including but not limited to reasonable attorneys’ fees and costs of suit, arising out of or in connection with either (A) any breach of a warranty, (B) any negligent or willful act or omission of Contractor or Contractor’s employees or agents, including but not limited to the extent such act or omission causes or contributes to any violation or claimed violation of a third parties’ rights arising in whole or in part from the grant of rights to Sapper hereunder or Sapper’s exercise of any such rights. Contractor will maintain adequate insurance to protect itself from and indemnify Sapper against claims giving rise to indemnification pursuant to this Paragraph. No limitation of liability shall apply to this indemnity obligation.

Sapper shall have the exclusive right to control its defense and/or the settlement. In no event shall Contractor settle any claim, action or proceeding without Sapper’s prior written approval.