Data Processing Addendum

Dated: 10 August 2026

This Data Processing Agreement and it’s Exhibits (“DPA”) are incorporated into, and are subject to, the Licence and Terms of Use Agreement between Digital Theatre.com Limited and its Affiliates (“Digital Theatre”) and the customer identified on the Order Form that is purchasing the Services (“You”) (hereafter known as the “Master Agreement”).

If You would like a signed copy of this DPA (including the full text of the SCCs and UK Addendum) which can be printed and executed by You, please download this here.

Please note that Digital Theatre update the DPA as described in the “Amendments” section below.

AGREED TERMS

1. Definitions and interpretation

The following definitions and rules of interpretation apply in this DPA. Terms not otherwise defined in this DPA will have the meaning set forth in the Master Agreement.

1.1 Definitions

California Personal Data: means Personal Data that is subject to the protection of the CCPA

CCPA: Means California Civil Code Sec. 1798.100 et seq (also known as the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (or “CPRA“)

Commissioner: the Information Commissioner (see Article 4(A3), UK GDPR and section 114, DPA 2018).

Data Protection Legislation: means all applicable legislation relating to data protection and privacy which applies to the respective party in the role of processing Personal Data in question under the Master Agreement; including without limitation European Data Protection Laws, the CCPA and other applicable U.S. federal and state privacy laws, and the data protection laws of Australia, Singapore, and Japan, in each case as amended, repealed, consolidated or replaced from time to time.

EEA: the European Economic Area.

Europe: means the European Union, the EEA and/or their member states, Switzerland, and the United Kingdom.

European Data: means Personal Data that is subject to the protection of European Data Protection Laws.

European Data Protection Laws: means data protection laws applicable in Europe, including: (i) Regulation 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of Personal Data and on the free movement of such data (General Data Protection Regulation) (EU GDPR); (ii) Directive 2002/58/EC concerning the processing of Personal Data and the protection of privacy in the electronic communications sector; and (iii) applicable national implementations of (i) and (ii); or (iii) GDPR as it forms part of the United Kingdom domestic law by virtue of Section 3 of the European Union (Withdrawal) Act 2018 (UK GDPR); and (iv) Swiss Federal Data Protection Ordinance (Swiss DPA); in each case, as may be amended, superseded or replaced.

Master Agreement: means the Digital Theatre Licence and Terms of Use Agreement which govern the provision of the Services to You, as such terms of agreement may be updated from time to time.

Personal Data Breach: a breach of security leading accidental, unauthorised, or unlawful destruction, loss, alteration, disclosure of, or access to, the Personal Data.

Records: has the meaning given to it in Clause 12.

Standard Contractual Clauses (SCCs): means the contractual clauses annexed to the European Commission’s Decision (EU) 2021/914 of 4 June 2021 currently found at: https://eur-lex.europa.eu/eli/dec_impl/2021/914 as may be amended from time to time.

Sub-processor: means any processor engaged by Digital Theatre or its Affiliates to assist in fulfilling its obligations with respect to providing the Services pursuant to the Master Agreement or this DPA. Sub-processors may include third parties or Affiliates of Digital Theatre but shall exclude Digital Theatre employees, contractors, or consultants.

Term: this DPA’s term as defined in Clause 10.

UK Addendum: means the International Data Transfer Addendum issued by the United Kingdom Commissioner under section 199A(1) of the Data Protection Act 2018 currently found at https://ico.org.uk/media/for-organisations/documents/4019539/international-data-transfer-addendum.pdf as many be amended, superseded, or replaced.

The terms “Personal Data”, “controller”, “processor” and “processing” shall have the meaning given to them under applicable Data Protection Laws or if not defined thereunder, the EU GDPR, and “process”, “processes” and “processed”, with respect to any of Your Personal Data, shall be interpreted accordingly.

The terms “Consumer”, “Business”, “Sell”, “Service Provider” and “Share” will have the meaning given to them under the CCPA.

The Exhibits form part of this DPA and will have effect as if set out in full in the body of this DPA. Any reference to this DPA includes the Exhibits.

A reference to writing or written includes email.

In the case of conflict or ambiguity between:

1. any provision contained in the body of this DPA and any provision contained in the Exhibits, the provision in the body of this DPA will prevail;
2. the terms of any accompanying invoice or other documents annexed to this DPA and any provision contained in the Exhibits, the provision contained in the Exhibits will prevail;
3. any of the provisions of this DPA and the provisions of the Master Agreement, the provisions of this DPA will prevail; and
4. any of the provisions of this DPA and any executed SCC, the provisions of the executed SCC will prevail.

2. Personal data types and processing purposes

You and Digital Theatre agree and acknowledge that for the purpose of the Data Protection Legislation:

1. You are the controller and Digital Theatre is the processor.
2. You retain control of the Personal Data and remain responsible for its compliance obligations under the applicable Data Protection Legislation, including but not limited to providing any required notices and obtaining any required consents, and for the written processing instructions it gives to Digital Theatre.
3. Exhibit A describes the subject matter, duration, nature and purpose of the processing and the Personal Data categories and Data Subject types in respect of which Digital Theatre may process the Personal Data to fulfil its contractual obligations to You under the Master Agreement.

3. Digital Theatre’s obligations

Digital Theatre will only process the Personal Data to the extent, and in such a manner, as is necessary for the purpose of fulfilling its contractual obligations to You under the Master Agreement, and in accordance with Your written instructions. Digital Theatre will not process the Personal Data for any other purpose or in a way that does not comply with this DPA or the Data Protection Legislation. Digital Theatre must promptly notify You if, in its opinion, Your instructions do not comply with the Data Protection Legislation.

Digital Theatre must comply promptly with any of Your written instructions requiring Digital Theatre to amend, transfer, delete or otherwise process the Personal Data, or to stop, mitigate or remedy any unauthorised processing.

Digital Theatre will maintain the confidentiality of the Personal Data and will not disclose the Personal Data to third parties unless You or this DPA specifically authorises the disclosure, or as required by domestic law, court or regulator (including the Commissioner). If a domestic law, court, or regulator (including the Commissioner) requires Digital Theatre to process or disclose the Personal Data to a third party, Digital Theatre must first inform You of such legal or regulatory requirement and give You an opportunity to object or challenge the requirement, unless the domestic law prohibits the giving of such notice.

Digital Theatre will reasonably assist You, at no additional cost to You, with meeting Your compliance obligations under the Data Protection Legislation, considering the nature of Digital Theatre’s processing and the information available to Digital Theatre, including in relation to Data Subject rights, data protection impact assessments and reporting to and consulting with the Commissioner or other relevant regulator under the Data Protection Legislation.

Digital Theatre must promptly notify You of any changes to the Data Protection Legislation that may reasonably be interpreted as adversely affecting Digital Theatre’s performance of the Master Agreement or this DPA.

4. Digital Theatre’s employees

Digital Theatre will ensure that all of its employees:

1. are informed of the confidential nature of the Personal Data and are bound by confidentiality obligations and use restrictions in respect of the Personal Data;
2. have undertaken training on the Data Protection Legislation relating to handling Personal Data and how it applies to their particular duties; and
3. are aware both of Digital Theatre’s duties and their personal duties and obligations under the Data Protection Legislation and this DPA.

Digital Theatre will take reasonable steps to ensure the reliability, integrity, and trustworthiness of and conduct background checks consistent with applicable domestic law on all Digital Theatre’s employees with access to the Personal Data.

5. Security

Digital Theatre must at all times implement appropriate technical and organisational measures against unauthorised or unlawful processing, access, copying, modification, reproduction, display or distribution of the Personal Data, and against accidental or unlawful loss, destruction, alteration, disclosure or damage of Personal Data including, but not limited to, the security measures set out in Exhibit B. Digital Theatre must document those measures in writing and periodically review them at least annually to ensure they remain current and complete.

Digital Theatre must implement such measures to ensure a level of security appropriate to the risk involved, including as appropriate:

1. the pseudonymisation and encryption of Personal Data;
2. the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services;
3. the ability to restore the availability and access to Personal Data in a timely manner in the event of a physical or technical incident; and
4. a process for regularly testing, assessing, and evaluating the effectiveness of the security measures.

6. Personal Data Breach

Digital Theatre will within forty-eight (48) hours and in any event without undue delay notify You if it becomes aware of:

1. the loss, unintended destruction or damage, corruption, or un-useability of part or all of the Personal Data. Digital Theatre will restore such Personal Data at its own expense as soon as possible.
2. any accidental, unauthorised, or unlawful processing of the Personal Data; or
3. any Personal Data Breach.

Where Digital Theatre becomes aware of (a), (b) and/or (c) above, it shall, without undue delay, also provide You with the following information:

1. description of the nature of (a), (b) and/or (c), including the categories of in-scope Personal Data and approximate number of both Data Subjects and the Personal Data records concerned;
2. the likely consequences; and
3. a description of the measures taken or proposed to be taken to address (a), (b) and/or (c), including measures to mitigate its possible adverse effects.

Immediately following any accidental, unauthorised, or unlawful Personal Data processing or Personal Data Breach, the parties will co-ordinate with each other to investigate the matter. Further, Digital Theatre will reasonably co-operate with You at no additional cost to You, in Your handling of the matter, including but not limited to:

1. assisting with any investigation;
2. providing You with physical access to any facilities and operations affected;
3. facilitating interviews with Digital Theatre’s employees, former employees and others involved in the matter including, but not limited to, its officers and directors;
4. making available all relevant records, logs, files, data reporting and other materials required to comply with all Data Protection Legislation or as otherwise reasonably required by You; and
5. taking reasonable and prompt steps to mitigate the effects and to minimise any damage resulting from the Personal Data Breach or accidental, unauthorised, or unlawful Personal Data processing.

Digital Theatre will not inform any third party of any accidental, unauthorised, or unlawful processing of all or part of the Personal Data and/or a Personal Data Breach without first obtaining Your written consent, except when required to do so by domestic law.

Digital Theatre agrees that You has the sole right to determine:

1. whether to provide notice of the accidental, unauthorised, or unlawful processing and/or the Personal Data Breach to any Data Subjects, the Commissioner, other in-scope regulators, law enforcement agencies or others, as required by law or regulation or in Your discretion, including the contents and delivery method of the notice; and
2. whether to offer any type of remedy to affected Data Subjects, including the nature and extent of such remedy.

Digital Theatre will cover all reasonable expenses associated with the performance of the obligations under 6.1 to 6.3 unless the matter arose from Your specific written instructions, negligence, wilful default or breach of this DPA, in which case You will cover all reasonable expenses.

Digital Theatre will also reimburse You for actual reasonable expenses that You incurs when responding to an incident of accidental, unauthorised, or unlawful processing and/or a Personal Data Breach to the extent that Digital Theatre caused such, including all costs of notice and any remedy as set out in clause 6.5.

7. Cross-border transfers of personal data

You acknowledge and agree that Digital Theatre may access and process Personal Data on a global basis as is necessary to provide the Service in accordance with the Master Agreement, and in particular that Personal Data may be transferred to, and processed by Digital Theatre, its Affiliates and Sub-processors in, other jurisdictions where Digital Theatre, its Affiliates and Sub-processors have operations.

When Personal Data is transferred outside of its country of origin, each party will ensure such transfers are made in compliance with the requirements of Data Protection Legislation.

Digital Theatre will not transfer European Data to any country or recipient not recognised as providing adequate level of protection for Personal Data (within the meaning of applicable European Data Protection Laws), unless it first takes all such measures as necessary to ensure the transfer is in compliance with applicable European Data Protection Laws. Such measures include:

1. transferring such data to a recipient that is in a territory which is subject to adequacy regulations recognised by Data Protection Legislation as providing an adequate level of protection of Personal Data; or
2. to a recipient that has executed the SCCs; and in each case as adopted or approved in accordance with applicable European Data Protection Laws.

If European Data Protection Laws require that appropriate safeguards are put in place (for example, if the recipient is not in a territory subject to adequacy regulations), the SCCs will be incorporated by reference and form part of this DPA as follows:

1. In relation to European Data that is subject to the EU GDPR:
1. You are the “data exporter” and Digital Theatre is the “data importer”;
2. the Module Two terms apply to the extent You are the controller of European Data and the Module Three terms apply to the extent Digital Theatre is a processor of European Data;
3. in Clause 7, the optional docking clause does not apply;
4. in Clause 9, Option 2 applies and changes to Sub-Processors will be notified in accordance with the “Sub-Processors” section of this DPA;
5. in Clause 11, the optional language is deleted;
6. in Clauses 17 and 18, the parties agree that the governing law and forum for disputes for the SCCs will be determined in accordance with English Law (without reference to conflicts of law principles);
7. the Annexes of the SCCs will be deemed completed with the information set out in the Exhibits to this DPA;
8. the supervisory authority that will act as competent supervisory authority will be determined in accordance with the EU GDPR; and
9. if and to the extent the SCCs conflict with any provision of this DPA, the SCCs will prevail to the extent of such conflict.
2. In relation to European Data that is subject to the UK GDPR, the SCCs will apply in accordance with sub-section 7.4 (a) and the following modifications:
1. the SCCs will be modified and interpreted in accordance with the UK Addendum, which will be incorporated by reference and form an integral part of this DPA;
2. Tables 1, 2 and 3 of the UK Addendum will be deemed completed with the information set out in the Exhibits of this DPA and Table 4 will be deemed completed by selecting “neither party”; and
3. any conflict between the terms of the SCCs and the UK Addendum will be resolved in accordance with Section 10 and Section 11 of the UK Addendum.
3. In relation to European Data that is subject to the Swiss DPA, the SCCs will apply in accordance with sub-section 7.4 (a) and the following modifications:
1. References to “Regulation (EU) 2016/679” will be interpreted as references to the Swiss DPA;
2. References to the “EU”, “Union”, and “Member State Law” will be interpreted as references to Swiss law; and
3. References to the “competent supervisory authority” and “competent courts” will be replaced with the “Swiss Federal Data Protection and Information Commissioner” and “the relevant courts in Switzerland”.

If Digital Theatre instructs a Sub-processor located outside the EEA in compliance with the provisions of clause 8, then You authorise Digital Theatre to enter into SCCs with the Sub-processor. Digital Theatre will make the executed SCCs available to You on request.

8. Sub-processors

You agree that Digital Theatre may engage Sub-processors to process Personal Data on Your behalf.

The Sub-processors currently engaged by Digital Theatre and authorised by You are set out in Exhibit A.

Digital Theatre must list all approved Sub-processors in Exhibit A and include any subcontractor's name and location and the contact information for the person responsible for privacy and data protection compliance.

If Digital Theatre add or replace any Sub-processors You will be notified by email, and You will be provided with an opportunity to object to the appointment of each subcontractor within thirty (30) working days after Digital Theatre supplies You with full details in writing regarding such Sub-processor. You can opt out of receiving such emails at any time.

Digital Theatre shall:

1. enter into a written contract with the Sub-processor that contains terms substantially the same as those set out in this DPA, in particular, in relation to requiring appropriate technical and organisational data security measures, to the extent applicable to the nature of the service provided by such Sub-processor; and
2. maintain control over all of the Personal Data it entrusts to the Sub-processor.

You acknowledge and agree that, where applicable, Digital Theatre fulfils its obligations under Clause 9 of the 2021 Controller-to-Processor Clauses and 2021 Processor-to-Processor Clauses (as applicable) by complying with this Section 3 and that Digital Theatre may be prevented from disclosing Sub-processor agreements to You due to confidentiality restrictions, but Digital Theatre shall, upon request, use reasonable efforts to provide You with all relevant information it reasonably can in connection with Sub-processor agreements.

9. Complaints, data subject requests and third-party rights

Digital Theatre must, at no additional cost to You, take such technical and organisational measures as may be appropriate, and promptly provide such information to You as You may reasonably require, to enable You to comply with:

1. the rights of Data Subjects under the Data Protection Legislation, including subject access rights, the rights to rectify, port and erase Personal data, object to the processing and automated processing of Personal data, and restrict the processing of Personal data; and
2. information or assessment notices served on You by the Commissioner or other relevant regulator under the Data Protection Legislation.

Digital Theatre must notify You immediately in writing if it receives any complaint, notice or communication that relates directly or indirectly to the processing of the Personal Data or to either party’s compliance with the Data Protection Legislation.

Digital Theatre must notify You within two (2) days if it receives a request from a Data Subject for access to their Personal Data or to exercise any of their other rights under the Data Protection Legislation.

Digital Theatre will give You, at no additional cost to You, its full co-operation and assistance in responding to any complaint, notice, communication, or Data Subject request.

Digital Theatre must not disclose the Personal Data to any Data Subject or to a third party other than in accordance with Your written instructions, or as required by domestic law.

10. Term and termination

This DPA will remain in full force and effect so long as:

1. the Master Agreement remains in effect; or
2. Digital Theatre retains any of the Personal Data related to the Master Agreement in its possession or control (Term).

Any provision of this DPA that expressly or by implication should come into or continue in force on or after termination of the Master Agreement in order to protect the Personal Data will remain in full force and effect.

Digital Theatre’s failure to comply with the terms of this DPA is a material breach of the Master Agreement. In such event, You may terminate any part of the Master Agreement involving the processing of the Personal Data effective immediately on written notice to Digital Theatre without further liability or obligation of You.

If a change in any Data Protection Legislation prevents either party from fulfilling all or part of its Master Agreement obligations, the parties may agree to suspend the processing of the Personal Data until that processing complies with the new requirements. If the parties are unable to bring the Personal Data processing into compliance with the Data Protection Legislation within fourteen (14) days, either party may terminate the Master Agreement with immediate effect on written notice to the other party.

11. Data return and destruction

At Your request, Digital Theatre will give You, or a third party nominated in writing by You, a copy of or access to all or part of the Personal Data in its possession or control in the format and on the media reasonably specified by You.

Subject to the provisions of this clause 11, on termination of the Master Agreement for any reason or expiry of its term, Digital Theatre will securely delete or destroy or, if directed in writing by You, return and not retain, all or any of the Personal Data related to this DPA in its possession or control.

Digital Theatre’s Platform automatically deletes certain categories of Personal data (Authorised User authentication data) after a pre-defined retention period of fourteen (14) months from an Authorised Users last authentication to the Platform, in accordance with Digital Theatre’s data retention policies, and You acknowledge this automated process is inherent to the Platform and cannot be altered.

If any law, regulation, or government or regulatory body requires Digital Theatre, or it is for Digital Theatre’s legitimate business requirements (such as maintaining accounting records, tax documentation, or evidence of processing activities), to retain any documents or materials or Personal Data that Digital Theatre would otherwise be required to return or destroy, Digital Theatre may retain copies of Personal Data.

Digital Theatre may retain and continue to process Personal Data that relates to ongoing business relationships, communications, or legitimate post-contract activities, provided that such processing is based on a valid lawful basis under applicable Data Protection Legislation. Such Personal Data shall be limited to what is necessary for the relevant purpose (for example, maintaining contact records in a customer relationship management system and handling outstanding communications).

Any Personal Data retained under this clause 11 shall:

1. be retained by Digital Theatre in compliance with applicable Data Protection Legislation and Digital Theatre’s retention policies.
2. remain subject to confidentiality, integrity, and security obligations set out in this DPA
3. not be used for any purpose other than stated in this DPA or required by law.
4. be permanently and securely deleted or destroyed by Digital Theatre once the applicable retention period expires.

Digital Theatre will certify in writing to You (upon Your request) that it has deleted or destroyed the Personal Data within two (2) days after it completes the deletion or destruction.

12. Records

Digital Theatre will keep detailed, accurate and up-to-date written records regarding any processing of the Personal Data, including but not limited to, the access, control and security of the Personal Data, the processing purposes, categories of processing, any transfers of Personal Data to a third country and related safeguards, and a general description of the technical and organisational security measures referred to in 5.1 (Records).

Digital Theatre will ensure that the Records are sufficient to enable You to verify Digital Theatre’s compliance with its obligations under this DPA and Digital Theatre will provide You with copies of the Records upon request.

You and Digital Theatre must review the information listed in the Exhibits to this DPA once a year to confirm its current accuracy and update it when required to reflect current practices.

13. Audit

Digital Theatre will permit You and its third-party representatives to audit Digital Theatre’s compliance with its DPA obligations, on at least fifteen (15) days’ notice, during the Term. Digital Theatre will give You and its third-party representatives all necessary assistance to conduct such audits. The assistance may include, but is not limited to:

1. physical access to, remote electronic access to, and copies of the Records and any other information held at Digital Theatre’s premises or on systems storing the Personal Data;
2. access to and meetings with any of Digital Theatre’s personnel reasonably necessary to provide all explanations and perform the audit effectively; and
3. inspection of all Records and the infrastructure, electronic data or systems, facilities, equipment or application software used to store, process the Personal Data.

The notice requirements in 13.1 will not apply if You reasonably believe that a Personal Data Breach occurred or is occurring, or Digital Theatre is in breach of any of its obligations under this DPA or any Data Protection Legislation.

If a Personal Data Breach occurs or is occurring, or Digital Theatre becomes aware of a breach of any of its obligations under this DPA or any Data Protection Legislation, Digital Theatre will:

1. five (5) days of the triggering event, conduct its own audit to determine the cause;
2. produce a written report that includes detailed plans to remedy any deficiencies identified by the audit;
3. provide You with a copy of the written audit report; and
4. remedy any deficiencies identified by the audit within fifteen (15) days.

At least once a year, Digital Theatre will conduct site audits of its Personal Data processing practices and the information technology and information security controls for all facilities and systems used in complying with its obligations under this DPA, including, but not limited to, obtaining a network-level vulnerability assessment performed by a recognised third-party audit firm based on recognised industry best practices.

On Your written request, Digital Theatre will make all of the relevant audit reports available to You for review. You will treat such audit reports as Digital Theatre’s confidential information under the Master Agreement.

Digital Theatre will promptly address any exceptions noted in the audit reports with the development and implementation of a corrective action plan by Digital Theatre's management.

14. Warranties

Digital Theatre warrants and represents that:

1. its employees, Sub-processors, agents and any other person or persons accessing the Personal Data on its behalf are reliable and trustworthy and have received the required training on the Data Protection Legislation;
2. it and anyone operating on its behalf will process the Personal Data in compliance with the Data Protection Legislation and other laws, enactments, regulations, orders, standards and other similar instruments;
3. it has no reason to believe that the Data Protection Legislation prevents it from providing any of the Master Agreement's contracted Services; and
4. considering the current technology environment and implementation costs, it will take appropriate technical and organisational measures to prevent the unauthorised or unlawful processing of Personal Data and the accidental loss or destruction of, or damage to, Personal Data, and ensure a level of security appropriate to:
1. the harm that might result from such unauthorised or unlawful processing or accidental loss, destruction or damage;
2. the nature of the Personal Data protected; and
3. comply with all applicable Data Protection Legislation and its information and security policies, including the security measures required in 5.1.

You warrant and represents that Digital Theatre's expected use of the Personal Data to fulfil its obligations to You under the Master Agreement and as specifically instructed by You will comply with the Data Protection Legislation.

15. Disclaimer

Notwithstanding anything to the contrary in the Master Agreement or this DPA, Digital Theatre and its Affiliates will not be liable for any claim made by a Data Subject arising from or related to Digital Theatre’s or any of its Affiliates acts or omissions, to the extent that Digital Theatre was acting in accordance with Your instructions.

16. Notice

Any notice given to a party under or in connection with this DPA must be in writing and delivered to:

For You: the details for notice as specified in the Master Agreement.

For Digital Theatre: Caroline Lambert, Data Protection Officer, Digital Theatre.com Limited, 51 Eastcheap, London, England, EC3M 1JP or dpo@digitaltheatre.com

17. Additional Provisions for California Personal Data

This clause shall only apply with respect to California Personal Data.

When processing California Personal Data in accordance with Your instructions, the Parties acknowledge and agree that You are a Business and Digital Theatre is a Service Provider for the purposes of the CCPA.

Digital Theatre certify that Digital Theatre will process California Personal Data as a Service Provider strictly for the purpose of performing the Services under the Master Agreement (the “Business Purpose”) or as otherwise permitted by the CCPA.

Further, Digital Theatre certify Digital Theatre:

1. will not Sell or Share California Personal Data;
2. will not process California Personal Data outside the direct business relationship between the Parties, unless required by applicable law; and
3. will not combine California Personal Data with Personal Data that Digital Theatre collect or receive from another source (other than information Digital Theatre receive from another source in connection with Digital Theatre’s obligations as a Service Provider under the Master Agreement).

Digital Theatre will:

1. comply with the obligations applicable to Digital Theatre as a Service Provider under the CCPA; and
2. provide California Personal Data with the same level of protection as is required by the CCPA.

Digital Theatre will notify You if Digital Theatre make a determination that Digital Theatre can no longer meet its obligations as a Service Provider under the CCPA.

You have the right to take reasonable and appropriate steps to help ensure that Digital Theatre use California Personal Data in a manner consistent with Your obligations under the CCPA. Upon notice, You will have the rights to take reasonable and appropriate steps in accordance with the Master Agreement to stop and remediate unauthorised use of California Personal Data.

The Parties acknowledge and agree that the disclosure of California Personal Data by You to Digital Theatre does not form part of any monetary or other valuable consideration exchanged between the Parties.

18. Amendments

Notwithstanding anything to the contrary in the Master Agreement, Digital Theatre reserves the right to make any updates and changes to this DPA, and the terms of the Master Agreement “Variation” and “Waiver” section of the Master Agreement will apply.

19. Severability

If any individual provisions of this DPA are determined to be invalid or unenforceable, the validity and enforceability of the other provisions of this DPA will not be affected.

20. Limitation of Liability

Each Party and each of their Affiliates liability, taken in aggregate, arising out of or related to this DPA (including any other DPAs between the parties) and the SCCs, where applicable, whether in contract or tort, will be subject to the limitations and exclusions of liability set out in the “Limitation of Liability” section of the Master Agreement, and any reference in such section to liability of a party means aggregate liability that party and all of its Affiliates under the Master Agreement (including this DPA).

In no event will either party’s liability be limited with respect to any individual’s data protection rights under this DPA (including any other DPAs between the Parties and the SCCs, where applicable) or otherwise

EXHIBIT A - Personal Data processing purposes and details

Data Exporter:

Name: You, as defined in the Master Agreement (on behalf of itself) and specified on the Order Form.

Address: Your address, as set out in the Order Form.

Contact person’s name, position and contact details: Your contact details, as set out in the Order Form and/or as provided to Digital Theatre from time to time in accordance with the Master Agreement.

Activities relevant to the data transferred under this DPA: processing of Personal Data in connection with the use of the Services under the Master Agreement.

Role (controller/processor): controller

Data Importer:

Name: Digital Theatre.com Limited

Address: 51 Eastcheap, London, England, EC3M 1JP

Contact person’s position, name and contact details: Data Protection Officer, Caroline Lambert, Digital Theatre.com Limited, 51 Eastcheap, London, England, EC3M 1JP, dpo@digitaltheatre.com

Name: Digital Theatre (US) LLC

Address: c/o Thorelli & Associates 70 West Madison St. Suite 5750 Chicago, IL 60602

Contact person’s position, name and contact details: Data Protection Officer, Caroline Lambert, Digital Theatre.com Limited, 51 Eastcheap, London, England, EC3M 1JP, dpo@digitaltheatre.com

Activities relevant to the data transferred under this DPA: processing of Personal Data in connection with the use of the Services under the Master Agreement.

Role (controller/processor): processor

Subject matter and nature of processing:

Digital Theatre provides an online educational subscription service, as more particularly described in the Master Agreement. The subject matter of the data processing under this DPA is the Personal Data. Personal Data will be processed in accordance with the Master Agreement (including this DPA) and may be subject to the following processing activities:

• Storage and other processing necessary to provide, maintain and improve the Services provided to You pursuant to the Master Agreement; and/or
• Disclosures in accordance with the Master Agreement and/or compelled by applicable law.

Frequency of the transfer:

Continuous.

Period for which Personal Data will be retained:

Digital Theatre processes Personal Data as outlined in clause 11 (Data Return and Destruction) of this DPA.

Purpose of Processing:

Digital Theatre shall only process Personal Data for the permitted purposes, which shall include (i) processing as necessary to provide the Services in accordance with the Master Agreement; (ii) processing initiated by You in Your use of the Services; (iii) processing to comply with any other reasonable instructions provided by You (e.g. via email or support requests) or Authorised Users that are consistent with the terms of the Master Agreement.

Personal Data Categories:

You may upload, submit, or otherwise provide certain Personal Data to the Service, the extent of which is typically determined and controlled by You in Your sole discretion, or Authorised Users in their sole discretion, and may include the following types of Personal Data:

• Contact Information, and any other Personal Data submitted by, sent to, or received by You, or Your Authorised Users, via the Platform and/or Services (as defined in the Master Agreement).

Data Subject Types:

You and Your Authorised Users may submit Personal Data in the course of using the Platform and/or Services, the extent of which is determined and controlled by You in Your sole discretion, and which may include, but is not limited to Personal Data relating to the following categories of Data Subjects:

• Your contacts and Authorised Users, including Your employees, contractors, collaborators, customers, prospects, suppliers, and subcontractors.

Sensitive Personal Data:

Digital Theatre does not knowingly, nor does it intentionally, collect or process any Sensitive Personal Data in connection with the provision of the Services to You and Authorised Users.

Legal Basis:

Digital Theatre's legal basis for processing Personal Data outside the EEA in order to comply with cross-border transfer restrictions are Standard Contractual Clauses (SCCs).

List of Sub-processors:

EXHIBIT B - Security measures

Digital Theatre observes the security measure described in this Exhibit B, all capitalised terms not otherwise defined herein will have the meanings as set forth in the Master Agreement. For more information regarding the security measures, please contact Data Protection Officer, Caroline Lambert, Digital Theatre.com Limited, 51 Eastcheap, London, England, EC3M 1JP, dpo@digitaltheatre.com

Physical access controls.

Preventing unauthorised access:

• Outsourced processing: Digital Theatre hosts its Service with outsourced AWS cloud infrastructure providers. Additionally, Digital Theatre maintains contractual relationships with providers in order to provide the Service in accordance with this DPA. Digital Theatre relies on contractual agreements, privacy policies, and provider compliance programs to protect data processed or stored by these providers.
• Physical and environmental security: Digital Theatre hosts the Platform infrastructure with multi-tenant, outsourced infrastructure providers. Digital Theatre does not own or maintain hardware located at outsourced infrastructure providers’ data centres. Servers and client-facing applications are logically and physically stored in Digital Theatre’s internal corporate information systems. The physical and environmental security controls are audited for PCI DSS, PSD2 and SCA among other certifications. Digital Theatre apply infrastructure, and security best practices, and follow AWS guidance on maintaining a secure environment.
• Authentication: Digital Theatre uses secure authentication methods. You or Your Authorised Users must authenticate to the Platform via Digital Theatre’s authentication Sub-Processor (OKTA), using an email address and password, SAML 2.0 (Security Assertion Markup Language 2.0) Single Sign On (SSO) or IP address.
• Authorisation: Personal Data is stored in multi-tenant storage systems accessible to You via only application user interfaces and application programming interfaces. You are not allowed direct access to the underlying application infrastructure The authorisation model is designed to ensure that only the appropriately assigned individuals can access relevant features, views, and customisation options. Authorisation to data sets is performed through validating the user’s permissions against the attributes associated with each data set.

Preventing unauthorised use:

• Digital Theatre implements industry standard access controls and detection capabilities for the internal networks that support the Platform.
• Network access control mechanisms are designed to prevent network traffic using unauthorised protocols from reaching the Platform infrastructure. The technical measures implemented differ between infrastructure providers and include Virtual Private Network (VPN), Virtual Private Cloud (VPC) implementations, security group assignment, traditional fire walls and load balancers.
• Digital Theatre implement a Web Application Firewall (WAF) solution to protect internet accessible applications. The WAF is designed to identify and protect attaches against publicly available network services.
• Code stored in Digital Theatre source code repositories is checked for best practices and identifiable software flaws using automated tooling.
• Digital Theatre maintains relationships with industry recognised penetration and Vulnerability testing service providers for penetration and Vulnerability testing of both the Digital Theatre applications and internal corporate network infrastructure at least annually. The intent of these penetration and Vulnerability tests to is to identify security Vulnerabilities and mitigate the risk and business impact they pose to the in-scope systems.
• All network traffic over public networks to the Platform infrastructure are sent over cryptographically secure encrypted connections, specifically HTTPS using TLS 1.2+ supporting the standard website server ports, TCP 80 and 443.

Platform access controls.

• A subset of Digital Theatre employees have access to the Services and to Your or Your Authorised Users Personal Data via controlled interfaces. The intent of providing access to a subset of employees is to provide effective Support Services, Service development and research, to troubleshoot for potential problems, to detect and respond to security incidents and implement data security. Access is enabled through Digital Theatre’s authentication Sub-Processor (OKTA). Access permissions granted to OKTA are provided on an as-needed basis with automatic expiry. Employees are granted access by role; frequent reviews of high-risk privilege grants and background checks on Employees are completed.

Data access controls.

• Where permitted by applicable law, Digital Theatre employees undergo a third-party background or reference checks.
• All employees are required to conduct themselves in a manner consistent with Digital Theatre’s guidelines, non-disclosure requirements, and ethical standards, and Digital Theatre implements disciplinary processes for violations of data security or privacy requirements.

Transmission controls.

• In transit Digital Theatre requires TLS encryption (Transport Layer Security version 2.1 or higher) across its Service and Platform, including authentication interfaces. Digital Theatre’s TLS implementation uses industry standard algorithms and certificates.
• At rest Digital Theatre stores user passwords following policies that follow industry standard practices for security. Digital Theatre have implemented technologies to ensure that stored data is encrypted at rest using symmetric 256-bit AES encryption with exclusive keys to Digital Theatre.

Input controls.

• Digital Theatre designed its infrastructure to log extensive information about the Platform behaviour, traffic received, Platform authentication, and other application requests. Internal systems aggregate log data and alert appropriate employees of malicious, unintended, or anomalous activities. Digital Theatre personnel, including security, operations, and Support Services personnel, are responsive to known incidents.
• Digital Theatre maintain a record of known security incidents that includes the description, dates and times of relevant activities, and incident disposition. Suspected and confirmed security incidents are investigated by security, operations, or Support Services personnel; and appropriate resolution steps are identified and documented. For any confirmed incidents, Digital Theatre will take appropriate steps to minimise damage or unauthorised disclosure. Notification to You will be in accordance with the terms of this DPA.

Data backups.

• Backup and replication strategies are designed to ensure redundancy and fail-over productions during a significant processing failure. Your Personal Data is backed up to multiple durable data stores and replicated across multiple availability zones.
• Where feasible, databases are designed to replicate data no less than 1 primary and 1 secondary database. All databases are backed up and maintained using at least industry standard methods.

Appendix 1 to the Standard Contractual Clauses

This Appendix forms part of the Standard Contractual Clauses (the “SCCs”).

Appendix 2 to the Standard Contractual Clauses

This Appendix forms part of the Standard Contractual Clauses (the “SCCs”).

A description of the technical and organisational security measures implemented by the data importer in accordance with SCCs are set out in Exhibit B of the DPA.

Appendix 3 to the Standard Contractual Clauses

This Appendix forms part of the Standard Contractual Clauses (the “SCCs”).

The List of Sub-Processors used by the data importer are listed in accordance with Clause 9(a) of the SCCs are set out in Exhibit A of the DPA.