Agreement and applicable Order Form(s) are deemed instructions to Process Personal Data as is necessary to perform services under the Agreement; (b) Users actions that initiate Processing while using the SCC Services; and (c) Customer’s other documented reasonable instructions provided by Customer (e.g., via email) where such instructions are consistent with the terms of the Agreement. (b) Notification of New Sub-processors and Objection Right for new Sub-processors. Customer acknowledges and expressly agrees that RELAYTO Limited may engage new Sub- processors as described in the DPA. (c) Copies of Sub-processor Agreements. The parties agree that RELAYTO LIMITED may redact the copies of the Sub-processor agreements that must be provided by RELAYTO LIMITED to Customer. RELAYTO LIMITED will provide copies of the Sub-processor agreements, only upon request by Customer. (d) Audits and Certifications. The parties agree that the audits shall be carried out in accordance with the following specifications. Customer request an on-site audit of the procedures relevant to the protection of Personal Data, and Customer and RELAYTO LIMITED shall mutually agree upon the scope, timing, and duration of the audit in addition to the reimbursement rate for which Customer shall be responsible. Customer shall promptly notify RELAYTO LIMITED with information regarding any non-compliance discovered during the course of an audit. 8.3 Certification of Deletion. The parties agree that the certification of deletion of Personal Data that is described in Standard Contractual Clauses shall be provided by RELAYTO Limited to Customer only upon Customer’s request. 8.4 Conflict. In the event of any conflict or inconsistency between the body of this DPA and the Standard Contractual Clauses, the Standard Contractual Clauses shall prevail. Support may be reached at support@relayto.com SCC STANDARD CONTRACTUAL CLAUSES (SCC) SECTION I Clause 1 Purpose and scope (a) The purpose of these standard contractual clauses is to ensure compliance with the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) 1 for the transfer of personal data to a third country. (b) The Parties: (i) the natural or legal person(s), public authority/ies, agency/ies or other body/ies 22 of 53