4. Sub-processors 4.1 Appointment of Sub-processors. Customer acknowledges and agrees that RELAYTO LIMITED may engage third-party Sub-processors in connection with the provision of the Services. RELAYTO LIMITED has entered into a written agreement with each Sub-processor containing data protection obligations not less protective than those in this Agreement with respect to the protection of Customer Data to the extent applicable to the nature of the Services provided by such Sub-processor. 4.2 List of Current Sub-processors and Notification of New Sub-processors. RELAYTO LIMITED’s current list of Sub-processors for the Services is attached as Annex III to the SCC applicable to the DPA. Such Sub-processor lists shall include the identities of those Sub-processors and their country of location (“Sub- processor Lists”). RELAYTO LIMITED shall provide Customer notification of potential new Sub-processor(s) before authorizing any new Sub-processor(s) to Process Personal Data. 4.3 Objection Right for New Sub-processors. Customer may object to RELAYTO LIMITED’s use of a new Sub-processor by notifying RELAYTO LIMITED promptly in writing within thirty (30) calendar days after receipt of RELAYTO LIMITED’s notice. In the event Customer objects to a new Sub- processor, as permitted in the preceding sentence, RELAYTO LIMITED will use reasonable efforts to make available to Customer a change in the Services or recommend a commercially reasonable change to Customer’s configuration or use of the Services to avoid Processing of Personal Data by the objected-to new Sub-processor without unreasonably burdening the Customer. If RELAYTO LIMITED is unable to make available such change within a reasonable period of time, which shall not exceed thirty (30) calendar days, Customer may terminate the applicable Order Form(s) with respect only to those Services which cannot be provided by RELAYTO LIMITED without the use of the objected-to new Sub-processor by providing written notice to RELAYTO LIMITED. RELAYTO LIMITED will refund Customer any prepaid fees covering the remainder of the term of such Order Form(s) following the effective date of termination with respect to such terminated Services, without imposing a penalty for such termination on Customer. 4.4 Liability. RELAYTO LIMITED shall be liable for the acts and omissions of its Sub-processors to the same extent RELAYTO LIMITED would be liable if performing the services of each Sub- processor directly under the terms of this DPA, except as otherwise set forth in the Agreement. 5. Security 5.1 Controls for the Protection of Customer Data. RELAYTO LIMITED shall maintain appropriate technical and organizational measures to ensure a level of security appropriate to the risk posed by the Processing. RELAYTO LIMITED’s measures will include those set forth in the Security Documentation attached as Annex II to the SCC applicable to the DPA. RELAYTO LIMITED regularly monitors compliance with these measures. RELAYTO LIMITED will not materially decrease the overall security of the Services during a subscription term. 19 of 54