VOEDX UTILITY DATA PROCESSING ADDENDUM

Last Updated: October 29, 2026

This Data Processing Addendum (the “Addendum”) to the VOEDX Utility Terms and Conditions (“Terms and Conditions”), by and between VOEDX Marketplace, LLC (“VOEDX”) and Authorized User (jointly referred to herein as the “Parties”), takes effect on the Effective Date.

RECITALS

WHEREAS, VOEDX provides certain services (the “Services”) to Authorized User pursuant to the Terms and Conditions; and

WHEREAS, in connection with the provision of the Services, VOEDX receives from Authorized User, or receives on its behalf, Subject Data and/or Subject Related Data; and

WHEREAS, certain applicable laws, including applicable privacy laws and the Fair Credit Reporting Act, as amended, codified at 15 U.S.C. § 1681 et seq., and its implementing regulations (collectively “FCRA”), where applicable to Authorized User, impose on Authorized User certain obligations with respect to Subject Data and Subject Related Data; and

WHEREAS, Authorized User seeks to supplement the Terms and Conditions with this Addendum to comply with applicable laws and obtain adequate safeguards for Subject Data and Subject Related Data.

NOW THEREFORE, for good and valuable consideration, the sufficiency of which hereby is acknowledged, the Parties agree to supplement the Terms and Conditions as follows:

ADDENDUM

The following provisions apply to VOEDX’s collection, retention, use, disclosure, and other handling, (collectively, “Processing”) of Subject Data and Subject Related Data:

Section 1- Definitions

1.Definitions. The capitalized terms in this Addendum shall have the meaning assigned to them in the Terms and Conditions. In addition, the following definitions apply to this Addendum:

1.1.“Background Check Information” has the meaning given in the Terms and Conditions.

1.2.“Data Security Incident” means the unauthorized access to, or use, disclosure, or acquisition of Subject Data or Subject Related Data in the possession of VOEDX, or its agents or subcontractors, that compromises the Subject Data’s or Subject Related Data’s availability, security, confidentiality, or integrity.

1.3.“Deidentified Data” means information that cannot reasonably be used to infer information about, or otherwise be linked to, a particular Individual or household, and with respect to which VOEDX (a) takes reasonable measures to ensure that the information cannot be associated with an Individual or household, (b) publicly commits to maintain and use the information in deidentified form and not to attempt to reidentify it, except as permitted by applicable law, and (c) contractually obligates any recipient of the information to comply with the foregoing. VOEDX may use the guidance in NIST Special Publication 800-188, as updated from time to time, in deidentifying information.

1.4.“Discover” with respect to a Data Security Incident, means knowledge, by a member of VOEDX’s workforce, other than the person responsible for the Data Security Incident, that the Data Security Incident has occurred, or circumstances under which such member of VOEDX’s workforce should have known that the Data Security Incident has occurred.

1.5.“Individual” means a natural person who is the subject of Personal Information.

1.6.“Personal Information” means information that (a) is Subject Data or Subject Related Data, and (b) identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular Individual.

1.7.“Process” means any operation or set of operations that are performed on Subject Data or Subject Related Data or on sets of Subject Data or Subject Related Data, whether or not by automated means.

1.8.“Subject Data”, for purposes of this Addendum, means the Authorized User’s Subject Data, as defined in the Terms and Conditions, that is purchased and/or sold by Authorized User using the Utility.

1.9.“Subject Related Data”, for purposes of this Addendum, means the Authorized User’s Subject Related Data, as defined in the Terms and Conditions.

Section 2 - General

2.General.

2.1.Data Ownership. VOEDX acknowledges that Authorized User is the controller of Subject Data and Subject Related Data, or is acting as a processor for the controller of Subject Data or Subject Related Data, that Authorized User provides to VOEDX for Processing hereunder.

2.2.Restrictions On Processing Subject Data and Subject Related Data. VOEDX is permitted to Process Subject Data and Subject Related Data only (a) on Authorized User’s behalf and to perform the Services, or (b) as otherwise permitted by the Terms and Conditions as supplemented by this Addendum.

2.3.Conduit. The Parties acknowledge that, in the course of providing the Services, VOEDX is acting as Processor (or Sub-Processor, if applicable) hereunder. The Parties further acknowledge that, in the course of providing the Services, VOEDX acts only as a conduit of Subject Data and that VOEDX does not assemble, evaluate, sell, re-sell, buy, assess the accuracy of, or broker Subject Data. VOEDX may Process Subject Data and Subject Related Data only (a) to receive, transiently store, transmit and deliver it as directed by the Authorized Users that are party to the applicable Transaction, including to confirm that a delivery conforms to the Utility’s technical format requirements; (b) to secure the Utility and to detect, prevent and investigate security incidents, fraud and misuse; (c) to maintain and troubleshoot the Utility; and (d) as required by applicable law. VOEDX does not review, evaluate or use the content of Subject Data for any other purpose, including to develop or improve the Services.

Section 3 – Authorized User’s Responsibilities

3.Authorized User’s Responsibilities.

3.1.Compliance With Applicable Law. Authorized User represents and warrants that it has full rights to provide Subject Data and Subject Related Data to VOEDX for Processing hereunder and that it has obtained any consents, and provided any notices, required by applicable law prior to providing Subject Data and Subject Related Data to VOEDX for Processing hereunder. Authorized User agrees to comply with its obligations under applicable law with respect to the Processing of Subject Data and Subject Related Data hereunder and not to instruct VOEDX to Process Subject Data or Subject Related Data hereunder in a manner that violates applicable law.

3.2.Data Security. Authorized User agrees to ensure the security of Subject Data and Subject Related Data in transmission or transfer to VOEDX, to the extent that Authorized User, or its subcontractor or agent, controls the transmission or transfer. If Authorized User becomes aware of an actual or suspected Data Security Incident, Authorized User will notify VOEDX within 48 hours. Authorized User represents and warrants that the Subject Data and Subject Related Data it transfers using the Utility shall be free of any virus, Trojan Horse, software, or other devices developed to disable or to erase, damage, or corrupt software, hardware, or data.

3.3.Sensitive Personal Information. With respect to any sensitive personal information (as designated under applicable law) submitted by Authorized User to VOEDX for processing, Authorized User represents that it has obtained all necessary consents or has another lawful basis for such processing by VOEDX. Authorized User agrees that it will not submit (i) health data (including mental health information); (ii) precise geolocation data; (iii) biometric data; (iv) genetic data; (v) data pertaining to children under the age of 16; (vi) contents of private communications (email, text messages, etc.); or (vii) information revealing citizenship or immigration status (including with respect to any individual located in New Jersey or Connecticut) to VOEDX for processing, except as expressly agreed in writing by VOEDX. Notwithstanding the foregoing, VOEDX will not agree to, and Authorized User shall not in any circumstances submit to VOEDX, (A) any data described in clause (i) above, including drug and alcohol test results; (B) any criminal record information (including information relating to arrests, charges, criminal convictions or criminal offenses) relating to any individual located in the European Economic Area, the United Kingdom or Switzerland; (C) any Background Check Information described in Section 13.7(c) of the Terms and Conditions; or (D) information revealing the citizenship or immigration status of any individual who resides in New Jersey or Connecticut. VOEDX agrees that it will process sensitive personal information (if and as applicable) only as strictly necessary to provide the Services (and will not use sensitive personal information (if and as applicable) for any purpose other than providing the Services).

3.4.Processor Authority. Where Authorized User processes Subject Data or Subject Related Data as a processor acting on behalf of one or more controllers, Authorized User represents and warrants that: (a) it has full legal authority from each such controller to engage VOEDX as a sub-processor for the Processing contemplated by this Addendum; (b) it has entered into, or will enter into prior to any transfer to VOEDX, a written agreement with each such controller that authorizes sub-processor engagement provided for hereunder; (c) its engagement of VOEDX as a sub-processor does not violate any applicable law or agreement with any such controller; and (d) it will promptly notify VOEDX if its authority to engage VOEDX as a sub-processor on behalf of any controller is revoked or materially limited.

Section 4 – VOEDX’s Responsibilities

4.VOEDX’s Responsibilities.

4.1.Restrictions on Disclosure of Subject Data and Subject Related Data to Subcontractors. VOEDX shall not disclose any Subject Data or Subject Related Data to any sub-processor, or permit any sub-processor to Process Subject Data or Subject Related Data on VOEDX’s behalf, unless the sub-processor agrees, by written agreement, to substantially similar restrictions on the Processing of Subject Data and Subject Related Data as those imposed by this Addendum on VOEDX. Prior to engaging any new sub-processor, VOEDX shall conduct a risk-based security assessment of the prospective sub-processor, which may include review of the sub-processor's SOC 2 report, security questionnaire or equivalent documentation. A list of VOEDX’s current sub-processors is set forth below in Appendix III to Annex A, which list VOEDX may update from time to time; provided, however, that VOEDX shall not add any new sub-processors without providing not less than thirty (30) days prior notice of the addition of the new sub-processor to Authorized User. If Authorized User does not approve of the addition of the new sub-processor, then Authorized User may terminate its relationship with VOEDX under the Terms and Conditions, without penalty, by providing written notice of termination to VOEDX prior to the expiration of such thirty (30) day notice period. VOEDX shall remain liable under this Addendum and the Terms and Conditions for any acts or omissions of any sub-processor that would constitute a breach of this Addendum if such acts or omissions had been committed by VOEDX.

4.2.Restrictions on Processing Personal Information. VOEDX will not (a) Process Personal Information outside the direct business relationship between Authorized User and VOEDX; (b) sell or share Personal Information. The delivery of Subject Data or Subject Related Data by VOEDX to a Buyer Authorized User at the direction of the Seller Authorized User in a Transaction is a disclosure by the Seller Authorized User to the Buyer Authorized User, made through VOEDX as the Seller Authorized User’s service provider and processor, and is not a sale or sharing of Personal Information by VOEDX. Utility Transaction Fees and Preexisting Bilateral Agreement Transaction Fees are paid for use of the Utility and are not consideration for any Personal Information; (c) use Personal Information for targeted advertising; or (d) combine Personal Information with personal information that it receives from, or on behalf of, another person or persons, or collects from its own interaction with an Individual.

California Service Provider Compliance. Without limiting the generality of the foregoing, with respect to Personal Information subject to the California Consumer Privacy Act (as amended by the California Privacy Rights Act), VOEDX certifies that it understands the restrictions in California Civil Code section 1798.140(ag)(1) and California Code of Regulations, title 11, section 7051(a) and will comply with them as they pertain to such information. VOEDX will not retain, use, or disclose Personal Information: (a) for any commercial purpose other than providing the Services specified in the Terms and Conditions; (b) outside of the direct business relationship between VOEDX and Authorized User; or (c) for any purpose other than as specified in this Addendum and the Terms and Conditions. The specific business purposes for which Authorized User discloses Personal Information to VOEDX are: receiving, transiently storing, transmitting and delivering Subject Data and Subject Related Data between Authorized Users in Transactions that the Authorized Users initiate using the Utility; transmitting a Buyer Authorized User’s requests for Subject Data to the Seller Authorized Users that the Buyer Authorized User selects or that offer the requested category of Subject Data; confirming that deliveries conform to the Utility’s technical format requirements; and securing, maintaining and troubleshooting the Utility. VOEDX shall comply with the CCPA as applicable to it and shall provide the same level of privacy protection as is required of Authorized User by the CCPA. Authorized User may take reasonable and appropriate steps to ensure that VOEDX uses Personal Information consistent with Authorized User’s obligations under the CCPA, which the Parties agree may be satisfied through the information and audit rights in Section 4.6, and, upon notice to VOEDX, may take reasonable and appropriate steps to stop and remediate any unauthorized use of Personal Information by VOEDX.

State Law Compliance. VOEDX acknowledges that this Addendum is intended to comply with applicable data protection requirements under applicable U.S. state comprehensive privacy laws, including the processor-contract requirements of such laws, if and as applicable, and agrees to comply with the requirements of such laws as they apply to VOEDX's processing of personal information hereunder.

GDPR Compliance. Where the General Data Protection Regulation (GDPR) applies to the processing of Subject Data or Subject Related Data, VOEDX agrees to comply with the obligations of a processor under GDPR Articles 28 and 32, including: (a) processing Personal Information only on documented instructions from Authorized User; (b) ensuring confidentiality of personnel authorized to process Personal Information; (c) implementing appropriate technical and organizational security measures; (d) assisting Authorized User in responding to data subject rights requests; (e) assisting Authorized User with security and breach notification obligations; (f) making available information necessary to demonstrate compliance with this Addendum; and (g) deleting or returning Personal Information after Services end as set forth in Section 4.10. VOEDX shall not engage sub-processors without prior authorization as set forth in Section 4.1. VOEDX will provide Authorized User with information reasonably necessary to conduct any required transfer impact assessment.

4.3.Requests by an Individual Directed to VOEDX. VOEDX will provide reasonable assistance to Authorized User in responding to consumer rights requests under applicable law in a timely manner, taking into account the nature of processing and information available to VOEDX. Such assistance may include, but is not limited to: (i) providing access to personal information in VOEDX's possession; (ii) facilitating correction or deletion of personal information as instructed by Authorized User (including deletion requests that Authorized User receives through a state data broker deletion mechanism); (iii) providing information about VOEDX's processing activities; and (iv) cooperating with Authorized User to verify Individual identity for rights requests.

VOEDX shall refer to the Seller Authorized User and the Buyer Authorized User that were party to the applicable Transaction, within three (3) business days of receipt, any request or dispute received by VOEDX directly from an Individual, including any request for disclosure of a consumer file or any dispute of the accuracy or completeness of information under the FCRA, and shall not otherwise respond to the merits of such request or dispute. Within ten (10) business days of receiving instructions from Authorized User, VOEDX will follow Authorized User’s reasonable instructions regarding VOEDX’s assistance in complying with a request by an Individual to exercise such rights, but only with respect to Personal Information maintained by VOEDX or its agents or subcontractors on behalf of Authorized User.

4.4.Deidentified Data. VOEDX may create Deidentified Data from Personal Information, as long as VOEDX does not reidentify the data and prohibits by contract any recipient of the Deidentified Data from reidentifying that data. Such Deidentified Data is not Personal Information, Subject Data or Subject Related Data. VOEDX shall take reasonable measures to ensure that Deidentified Data cannot be used to infer information about, or otherwise be linked to, a particular Individual, and shall not attempt to reidentify such data.

4.5.Safeguards for Subject Data and Subject Related Data. VOEDX shall maintain an information security program for Subject Data and Subject Related Data that includes technical, physical, and administrative safeguards appropriate to the nature, scope, and purpose of the Processing to protect against reasonably foreseeable risks to the security, confidentiality and integrity of Subject Data and Subject Related Data which risks could result in the unauthorized acquisition, disclosure, use, alteration, destruction or other compromise of the Subject Data or Subject Related Data. Such safeguards shall include, as appropriate: encryption of data in transit and at rest using industry-standard protocols; network security controls; access controls with authentication mechanisms; regular security updates and patching; system monitoring and logging; backup and recovery procedures; and personnel security measures. VOEDX agrees that it has and will maintain a process for identifying, assessing, and mitigating the risks to Subject Data and Subject Related Data in each relevant area of VOEDX's operations and evaluating the effectiveness of the safeguards for controlling these risks.

4.6.Validation of Safeguards. VOEDX shall make available to Authorized User upon request such information as is reasonably necessary to demonstrate VOEDX's compliance with its obligations under this Addendum and applicable law. VOEDX may satisfy this obligation by providing Authorized User with a current SOC 2 Type II report issued by an independent, accredited auditor or a security questionnaire completed by VOEDX, which the parties agree shall constitute sufficient demonstration of compliance absent specific documented evidence of a material breach of this Addendum by VOEDX.

Authorized User may request an audit of VOEDX's data processing activities no more than once per calendar year, subject to the following conditions: (i) Authorized User shall provide VOEDX with no less than sixty (60) days prior written notice of any requested audit; (ii) any audit shall be conducted during VOEDX's normal business hours and in a manner that minimizes disruption to VOEDX's operations and personnel; (iii) Authorized User shall bear all costs and expenses associated with any audit; (iv) any auditor engaged by Authorized User shall execute a confidentiality agreement reasonably acceptable to VOEDX prior to commencing any audit; (v) the scope of any audit shall be limited to VOEDX’s data processing activities directly related to Authorized User's personal data under this Addendum; (vi) Authorized User shall provide VOEDX with a copy of any audit findings prior to finalization, and VOEDX shall have a reasonable opportunity to review and respond to such findings; and (vii) any audit shall be limited to review of VOEDX’s policies, procedures, records, certifications and third-party audit reports and interviews of knowledgeable personnel (and, for an audit following a Data Security Incident, the controls relevant to that incident), and no audit shall include access to VOEDX’s source code, production systems or networks, or to the data of any other Authorized User, or any penetration or vulnerability testing.

Notwithstanding the foregoing, Authorized User may request an additional audit outside of the annual limitation solely in the event of a confirmed material security incident directly affecting Authorized User's personal data, provided that such additional audit shall be limited in scope to the specific subject matter of such security incident.

Authorized User agrees to treat all information obtained through any audit as VOEDX's confidential information, subject to the confidentiality provisions of the Terms and Conditions. Authorized User shall not use audit rights in a manner that would interfere with VOEDX's business operations or compromise the security or confidentiality of other Authorized Users' data.

4.7.Data Security Incident Response Plan. VOEDX will maintain a written security incident response plan intended to ensure that any Data Security Incident will be promptly Discovered and addressed. VOEDX shall test its incident response plan at least annually, including through tabletop exercises or equivalent testing methods.

4.8.Reporting Data Security Incident. VOEDX shall report to Authorized User any Data Security Incident that VOEDX Discovers. VOEDX will provide Authorized User with a brief initial acknowledgment within forty-eight (48) hours of Discovery of a confirmed or suspected Data Security Incident, advising that an investigation is underway, and will follow with the full written report within seventy-two (72) hours of Discovery. The written report shall include, to the extent available at the time of reporting: (a) a description of the Data Security Incident; (b) the date the Data Security Incident occurred (if known); (c) the date the Data Security Incident was Discovered; (d) the categories and approximate number of Individuals whose Personal Information may be affected; (e) the categories and approximate volume of Personal Information affected; and (f) contact information for the person at VOEDX principally responsible for handling the Data Security Incident. VOEDX will provide updates as material new information becomes available.

4.9.Demands to Produce Subject Data or Subject Related Data Directed to VOEDX. VOEDX shall, to the extent legally permitted, (a) promptly notify Authorized User of any judicial or administrative order, subpoena, civil discovery request or other legal process requiring or requesting that VOEDX produce Subject Data or Subject Related Data; and (b) provide Authorized User with reasonable time to exercise its legal options to prohibit or limit disclosure of Subject Data or Subject Related Data before VOEDX produces any Subject Data or Subject Related Data, except where VOEDX is legally prohibited from delaying production or where immediate production is required by court order.

4.10.Deletion of Subject Data and Subject Related Data.

4.10.1.Deletion. VOEDX shall delete Subject Data and Subject Related Data within thirty (30) days after the earlier of (a) delivery of the applicable Subject Data to the Buyer and (b) cancellation or failure of the applicable Transaction, except to the extent retention is required by applicable law or for legal or audit purposes as provided in Section 7.9 of the Terms and Conditions. VOEDX shall delete Subject Data and Subject Related Data in a manner reasonably intended to ensure that the Subject Data and Subject Related Data is unrecoverable.

4.10.2.VOEDX’s Retention of Subject Data and Subject Related Data. If, at least five (5) business days before the date by which VOEDX is required to delete any Subject Data or Subject Related Data under subsection 4.10.1, VOEDX delivers to Authorized User written notice explaining the conditions that make deletion of that Subject Data or Subject Related Data infeasible, then Authorized User, in its sole and absolute discretion, may excuse VOEDX from complying, in whole or in part, with subsection 4.10.1 as to that Subject Data or Subject Related Data. If Authorized User does excuse compliance with subsection 4.10.1, in whole or in part, VOEDX agrees that, with respect to the Subject Data or Subject Related Data for which compliance with subsection 4.10.1 has been excused, VOEDX shall extend the protections of the Terms and Conditions and this Addendum to the retained Subject Data or Subject Related Data and limit further uses and disclosures of the retained Subject Data or Subject Related Data to those purposes that make deletion infeasible, for as long as VOEDX maintains such Subject Data or Subject Related Data, but in no event longer than twelve (12) months from the date by which such Subject Data or Subject Related Data would otherwise have been deleted under subsection 4.10.1, absent a continuing legal hold or regulatory requirement.

4.11.Inability to Meet Obligations. VOEDX will notify Authorized User promptly if VOEDX determines that it can no longer meet its obligations under this Addendum.

4.12.International Data Transfers. This Addendum primarily governs the processing of Subject Data and Subject Related Data of individuals located within the United States. VOEDX shall not process Subject Data or Subject Related Data outside the United States except in compliance with all applicable provisions of this Addendum (including Section 4.1 above). Authorized User shall not provide Subject Data or Subject Related Data to VOEDX for processing hereunder that pertains to individuals located outside of the United States without VOEDX’s prior written consent. VOEDX shall not consent to the provision of, and Authorized User shall not provide, criminal record information (including personal data relating to criminal convictions and offences within the meaning of Article 10 of the General Data Protection Regulation (EU) 2016/679) relating to any individual located in the European Economic Area, the United Kingdom or Switzerland.

In the event that Authorized User, with VOEDX’s prior written consent, provides Subject Data or Subject Related Data to VOEDX for processing hereunder that pertains to individuals located in the European Economic Area, the United Kingdom or Switzerland, then the following provisions shall apply:

(a)EU GDPR Transfers

Where Authorized User is subject to the General Data Protection Regulation (EU GDPR) and transfers Personal Information of individuals located in the European Economic Area to VOEDX:

(i)If Authorized User is a controller, the Standard Contractual Clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 (General Data Protection Regulation), as approved by European Commission Implementing Decision (EU) 2021/914 of 4 June 2021, Module 2 (Controller to Processor), are hereby incorporated by reference and shall apply. The Parties' details and other information required to complete the Standard Contractual Clauses are set forth in Annex A to this Addendum.

(ii)If Authorized User is a processor acting on behalf of another controller, the Standard Contractual Clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 (General Data Protection Regulation), as approved by European Commission Implementing Decision (EU) 2021/914 of 4 June 2021, Module 3 (Processor to Processor), are hereby incorporated by reference and shall apply. The Parties' details and other information required to complete the Standard Contractual Clauses are set forth in Annex B to this Addendum.

(b)UK GDPR Transfers

Where Authorized User is subject to the UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018 and transfers Personal Information of individuals located in the United Kingdom to VOEDX:

(i)The EU Standard Contractual Clauses incorporated in subsection (a) above shall apply to such UK transfers, as modified by the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, Version B1.0, issued by the UK Information Commissioner's Office and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022, which Addendum is hereby incorporated by reference (the "UK Addendum").

(ii)The Parties' details and other information required to complete the UK Addendum are set forth in Annex C (if Authorized User is a controller) or Annex D (if Authorized User is a processor) to this Addendum.

(c)Swiss Federal Act on Data Protection Transfers

Where Authorized User is subject to the Swiss Federal Act on Data Protection (FADP) and transfers Personal Information of individuals located in Switzerland to VOEDX, the EU Standard Contractual Clauses incorporated in subsection (a) above shall apply to such Swiss transfers, with the following modifications: (i) references to "GDPR" shall be deemed to refer to the Swiss Federal Act on Data Protection; (ii) references to "EU Member State supervisory authority" shall be deemed to refer to the Swiss Federal Data Protection and Information Commissioner; (iii) the governing law shall be the laws of Switzerland; and (iv) such other modifications as may be required by the Swiss Federal Data Protection and Information Commissioner.

(d)General Provisions for Standard Contractual Clauses

For purposes of the EU Standard Contractual Clauses, UK Addendum, and any Swiss modifications:

(i)"data exporter" means Authorized User;

(ii)"data importer" means VOEDX;

(iii)the optional clauses and docking clause shall not apply unless otherwise agreed in writing;

(iv)the competent supervisory authority shall be as specified by Authorized User in the applicable Annex;

(v)the governing law shall be the law of Ireland (or, for UK transfers, the laws of England and Wales, or for Switzerland transfers, the laws of Switzerland);

(vi)the forum for dispute resolution shall be the courts of Ireland (or, for UK transfers, the courts of England and Wales).

(e)Compliance and Conflicts

The Parties agree to comply with all obligations set forth in the Standard Contractual Clauses, UK Addendum, and any Swiss modifications as incorporated herein. In the event of any conflict between this Addendum and the incorporated transfer mechanisms, the transfer mechanisms shall prevail to the extent required by applicable law.

Section 5 - Miscellaneous

5.Miscellaneous.

5.1.Indemnification. Each Party (as "Indemnifying Party") shall defend, indemnify, and hold harmless the other Party (as "Indemnified Party") from and against third-party claims, damages, liabilities, and reasonable attorneys' fees to the extent arising from: (a) the Indemnifying Party's breach of its obligations under this Addendum; (b) the Indemnifying Party's gross negligence or willful misconduct in connection with the Processing of Subject Data or Subject Related Data; (c) in the case of VOEDX as Indemnifying Party, any unauthorized Processing of Subject Data or Subject Related Data by VOEDX that violates this Addendum; or (d) in the case of Authorized User as Indemnifying Party, instructions provided by Authorized User that result in Processing that violates applicable law. The Indemnifying Party's obligations under this Section 5.1 shall not apply to the extent claims arise from: (i) the Indemnified Party's own breach of this Addendum, negligence, or willful misconduct; (ii) the Indemnified Party's failure to comply with applicable law; (iii) matters outside the Indemnifying Party's reasonable control; or (iv) regulatory inquiries or investigations that do not result in a finding of violation by the Indemnifying Party. The foregoing indemnification obligations are subject to the limits of Section 18 of the Terms and Conditions.

5.2.Indemnification Process. The foregoing indemnification obligations are conditioned on the indemnified Party: (a) notifying the indemnifying Party promptly in writing of such action; and (b) reasonably cooperating and assisting in such defense.

5.3.No Third-Party Beneficiaries. No third party shall be considered a third-party beneficiary under this Addendum, nor shall any third party have any rights as a result of this Addendum, except as provided in the Standard Contractual Clauses, the UK Addendum or any Swiss modifications incorporated under Section 4.12.

5.4.Precedence of Provisions. To the extent that any provision in this Addendum conflicts with a provision in the Terms and Conditions with respect to the Processing of Subject Data or Subject Related Data, this Addendum shall prevail; provided, however, that nothing in this Addendum shall expand VOEDX’s liability beyond the limitations set forth in Section 18 of the Terms and Conditions.

5.5.Survival. VOEDX’s obligations and duties under the Terms and Conditions and this Addendum with respect to Subject Data or Subject Related Data received by VOEDX or created by VOEDX while performing under the Terms and Conditions, or on Authorized User’s behalf, shall survive the termination of the Terms and Conditions and of this Addendum and shall continue for as long as that Subject Data or Subject Related Data remains in the possession of VOEDX or of its subcontractors.

6.Electronic Acceptance. Without limiting the effectiveness of a manual signature of this Addendum below, Authorized User’s acceptance of this Addendum by electronic means (including by checking a box and clicking “I Agree” or a similar button) through the Authorized User Portal by a person authorized to bind Authorized User shall constitute Authorized User’s execution of this Addendum, effective as of the Effective Date.

IN WITNESS WHEREOF, the undersigned have caused this Addendum to be executed and delivered by their duly authorized officers.

VOEDX MARKETPLACE, LLC

By: _______________________

Name: Anthony Petraco

Title: CEO

AUTHORIZED USER

By: _______________________________

Name: _________________________

Title: _________________________

Entity Name: _______________________

ANNEX A

INFORMATION FOR STANDARD CONTRACTUAL CLAUSES

Module 2: Controller to Processor

This Annex A applies where Authorized User is a controller subject to the GDPR and VOEDX processes Personal Information as a processor on behalf of Authorized User.

The Parties agree to be bound by the Standard Contractual Clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679, as approved by European Commission Implementing Decision (EU) 2021/914 of 4 June 2021, Module 2 (Controller to Processor), which are incorporated by reference into this Addendum as set forth in Section 4.12.

The Standard Contractual Clauses are publicly available from the European Commission.

The information required to complete the Appendices to the Standard Contractual Clauses is set forth below.

Capitalized terms used and not otherwise defined herein shall have the meanings assigned to such terms in the Terms and Conditions.

APPENDIX I: PARTIES AND DESCRIPTION OF TRANSFER

(To Standard Contractual Clauses - Module 2)

A. LIST OF PARTIES

Data exporter:

Name: ________________________

(Insert Authorized User Entity Name Above)

Address: As set forth in Authorized User’s Account

Contact person's name, position and contact details: As set forth in Authorized User’s Account

Activities relevant to the data transferred: Consumer reporting agency or furnisher of information utilizing the VOEDX Utility to buy and sell employment verification and other data

Role: Controller

Data importer:

Name: VOEDX Marketplace, LLC

Address: 4 May Hill Lane, Dix Hills, NY 11746

Contact: privacy@voedx.com

Activities relevant to the data transferred: Provider of the VOEDX Utility platform that facilitates transactions of employment verification and other data

Role: Processor

B. DESCRIPTION OF TRANSFER

Categories of data subjects:

- Individuals who are the subject of verification of employment, background check and similar inquiries

- Individuals about whom employment-related information is verified

Categories of personal data transferred:

- Identifiers (name, address, Social Security number, date of birth)

- Employment and similar information (employer name, job title, dates of employment, salary)

- Background Check Information approved by VOEDX under Section 1.1 of the Terms and Conditions, excluding criminal record information and health information (which will not be transferred in any circumstances)

- Professional information (work history, credentials, licenses)

- Contact information

Sensitive data transferred (if applicable):

Subject Data and Subject Related Data may include information that is classified as sensitive under applicable law, such as Social Security numbers or other government identification numbers as necessary for employment verification. Authorized User represents that it has obtained all necessary consents or has another lawful basis for transfer of such data. The categories of sensitive data listed in Section 3.3 of this Addendum (health data, precise geolocation data, biometric data, genetic data, data pertaining to children under 16, contents of private communications, and citizenship or immigration status) will not be transferred except as expressly agreed in writing by VOEDX. Health data (including drug and alcohol test results) and criminal record information (including personal data relating to criminal convictions and offences) will not be transferred in any circumstances.

Frequency of transfer: Continuous during term of Services

Nature of processing: Collection, storage, transmission, and deletion of Subject Data and/or Subject Related Data to facilitate transactions between Authorized Users

Purpose(s): To enable Authorized User to buy and sell verification of employment and other data through the VOEDX Utility

Retention period: Transient. Subject Data and Subject Related Data are deleted within thirty (30) days after delivery or cancellation of the applicable Transaction, and otherwise as specified in Section 4.10 of this Addendum.

Sub-processors: See Appendix III below

C. COMPETENT SUPERVISORY AUTHORITY

The competent supervisory authority shall be the supervisory applicable authority in the EU Member State where Authorized User is established as specified by Authorized User.

APPENDIX II: TECHNICAL AND ORGANISATIONAL SECURITY MEASURES

(To Standard Contractual Clauses - Module 2)

VOEDX implements the technical and organizational security measures described in Section 4.5 (Safeguards for Subject Data and Subject Related Data) and Section 4.6 (Validation of Safeguards) of this Addendum, which measures include:

Physical Security:

- Data centers with 24/7 physical security and restricted access

- Environmental controls (temperature, humidity, fire suppression)

Technical Security:

- Encryption of data in transit and at rest using industry-standard protocols

- Network security (firewalls, intrusion detection/prevention)

- Access controls with role-based permissions and multi-factor authentication

- Regular security patching and updates

- Logging and monitoring of system access

- Secure backup and disaster recovery procedures

Organizational Security:

- Written security policies and procedures

- Confidentiality agreements for personnel

- Security training for employees

- Incident response plan (Section 4.7)

- Vendor management program for sub-processors (Section 4.1)

- Validation of safeguards (as specified in Section 4.6)

Data Minimization and Retention:

- Processing limited to what is necessary for Services

- Retention as specified in Section 4.10

- Secure deletion procedures

Access Controls:

- Principle of least privilege

- Regular review of access permissions

- Prompt revocation upon termination

Compliance:

VOEDX maintains SOC 2 Type II level compliance with respect to the processing of Subject Data and Subject Related Data (including storage of data in SOC 2 Type II facility). VOEDX shall verify such compliance upon Authorized User's written request by providing Authorized User with a current SOC 2 Type II report issued by an independent, accredited auditor or by providing Authorized User with a security questionnaire completed by VOEDX.

APPENDIX III: LIST OF SUB-PROCESSORS

(To Standard Contractual Clauses - Module 2)

The current list of sub-processors authorized by Authorized User is set forth below.

Sub-processor Name	Description of Processing (Nature & Purpose)	Location of Processing
Microsoft Corporation (Microsoft Azure)	Provision of cloud infrastructure services, including data hosting, storage, and compute resources necessary for the performance of the Services	United States

VOEDX shall provide notice of changes to sub-processors as set forth in Section 4.1, including not less than thirty (30) days' prior notice of any new sub-processor.

Each sub-processor is bound by written agreement to substantially similar obligations as those imposed on VOEDX under this Addendum, as required by Section 4.1.

ANNEX B

INFORMATION FOR STANDARD CONTRACTUAL CLAUSES

Module 3: Processor to Processor

This Annex B applies where Authorized User is a processor subject to the GDPR acting on behalf of a controller, and VOEDX processes Personal Information as a sub-processor.

The Parties agree to be bound by the Standard Contractual Clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679, as approved by European Commission Implementing Decision (EU) 2021/914 of 4 June 2021, Module 3 (Processor to Processor), which are incorporated by reference into this Addendum as set forth in Section 4.12.

The Standard Contractual Clauses are publicly available from the European Commission.

The information required to complete the Appendices to the Standard Contractual Clauses is set forth below.

Capitalized terms used and not otherwise defined herein shall have the meanings assigned to such terms in the Terms and Conditions.

APPENDIX I: PARTIES AND DESCRIPTION OF TRANSFER

(To Standard Contractual Clauses - Module 3)

A. LIST OF PARTIES

Data exporter:

Name: ________________________

(Insert Authorized User Entity Name Above)

Address: As set forth in Authorized User’s Account

Contact person's name, position and contact details: As set forth in Authorized User’s Account

Activities relevant to the data transferred: Processor acting on behalf of a controller to process employment verification and other data

Role: Processor

Name and contact details of controller(s) on whose behalf the processor is acting: Authorized User processes Personal Information as a processor on behalf of its customers, which are businesses and other organizations that use Authorized User's services to obtain verification of employment and other data. Such controllers may change from time to time during the term of this Addendum. Authorized User represents and warrants that it is authorized by each such controller to engage VOEDX as a sub-processor and to enter into these Standard Contractual Clauses on behalf of such controllers.

Data importer:

Name: VOEDX Marketplace, LLC

Address: 4 May Hill Lane, Dix Hills, NY 11746

Contact: privacy@voedx.com

Activities relevant to the data transferred: Sub-processor providing the VOEDX Utility platform to facilitate transactions of employment verification and other data

Role: Sub-processor

B. DESCRIPTION OF TRANSFER

Categories of data subjects:

- Individuals who are the subject of verification of employment, background check and similar inquiries

- Individuals about whom employment-related information is verified

Categories of personal data transferred:

- Identifiers (name, address, Social Security number, date of birth)

- Employment and similar information (employer name, job title, dates of employment, salary)

- Professional information (work history, credentials, licenses)

- Contact information

Sensitive data transferred (if applicable):

Frequency of transfer: Continuous during term of Services

Nature of processing: Collection, storage, transmission, and deletion of Subject Data and/or Subject Related Data to facilitate transactions between Authorized Users

Purpose(s): To enable Authorized User (processor) to facilitate verification of employment and other data transactions as instructed by its controller

Sub-processors: See Appendix III below

C. COMPETENT SUPERVISORY AUTHORITY

The competent supervisory authority shall be the supervisory applicable authority in the EU Member State where Authorized User is established as specified by Authorized User.

APPENDIX II: TECHNICAL AND ORGANISATIONAL SECURITY MEASURES

(To Standard Contractual Clauses - Module 3)

See Annex A, Appendix II of this DPA

APPENDIX III: LIST OF SUB-PROCESSORS

(To Standard Contractual Clauses - Module 3)

See Annex A, Appendix III of this DPA

ANNEX C

INFORMATION FOR UK INTERNATIONAL DATA TRANSFER ADDENDUM

Controller to Processor

This Annex C applies where Authorized User is a controller subject to the UK GDPR and Data Protection Act 2018, and transfers Personal Information of individuals located in the United Kingdom to VOEDX.

The Parties agree to be bound by:

(1) The EU Standard Contractual Clauses (Module 2: Controller to Processor) as set forth in Annex A; and

(2) The International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, Version B1.0 (the "UK Addendum"), issued by the UK Information Commissioner's Office on 2 February 2022, which is incorporated by reference into this Addendum as set forth in Section 4.12.

The UK Addendum is publicly available from the UK Information Commissioner's Office.

Capitalized terms used and not otherwise defined herein shall have the meanings assigned to such terms in the Terms and Conditions.

INFORMATION REQUIRED FOR UK ADDENDUM

The information required to complete the UK Addendum Tables is set forth below:

TABLE 1: PARTIES

Data Exporter:

Name: ________________________

(Insert Authorized User Entity Name Above)

Address: As set forth in Authorized User’s Account

Contact: As set forth in Authorized User’s Account

Key Contact: The Designated Representative set forth in Authorized User’s Account

Data Importer:

Name: VOEDX Marketplace, LLC

Address: 4 May Hill Lane, Dix Hills, NY 11746

Contact: privacy@voedx.com

Key Contact: Privacy Officer, privacy@voedx.com

TABLE 2: SELECTED SCCs, MODULES AND SELECTED CLAUSES

Addendum EU SCCs: The version of the Approved EU SCCs which the UK Addendum is appended to, as set out in Annex A (EU Standard Contractual Clauses approved by Commission Implementing Decision (EU) 2021/914 of 4 June 2021).

Selected Module: Module 2 (Controller to Processor)

TABLE 3: APPENDIX INFORMATION

Annex 1A - List of Parties: See Annex A, Appendix I.A of this DPA

Annex 1B - Description of Transfer: See Annex A, Appendix I.B of this DPA

Annex II - Technical and Organisational Measures: See Annex A, Appendix II of this DPA

Annex III - List of Sub-Processors: See Annex A, Appendix III of this DPA

TABLE 4: ENDING THIS ADDENDUM WHEN THE APPROVED ADDENDUM CHANGES

Ending this Addendum when the Approved Addendum changes:

Which Parties may end this Addendum as set out in Section 19 of the UK Addendum:

☐ Importer

☐ Exporter

☒ Either Party

NOTES FOR TABLE 4:

For the purposes of Table 4 of the UK Addendum, either Party may terminate the UK Addendum as set out in Section 19 of the UK Addendum solely in the event that compliance with an updated Approved Addendum would require a material change to the data processing activities contemplated by this Addendum. Prior to exercising any termination right under this Section, the terminating Party shall provide the other Party with written notice and the parties shall negotiate in good faith for a period of thirty (30) days to adopt any updated Approved Addendum or agree on an alternative transfer mechanism.

ANNEX D

INFORMATION FOR UK INTERNATIONAL DATA TRANSFER ADDENDUM

Processor to Processor (Sub-processor)

This Annex D applies where Authorized User is a processor subject to the UK GDPR and Data Protection Act 2018 acting on behalf of a controller, and transfers Personal Information of individuals located in the United Kingdom to VOEDX as sub-processor.

The Parties agree to be bound by:

(1) The EU Standard Contractual Clauses (Module 3: Processor to Processor) as set forth in Annex B; and

The UK Addendum is publicly available from the UK Information Commissioner's Office.

Capitalized terms used and not otherwise defined herein shall have the meanings assigned to such terms in the Terms and Conditions.

INFORMATION REQUIRED FOR UK ADDENDUM

The information required to complete the UK Addendum Tables is set forth below:

TABLE 1: PARTIES

Data Exporter:

Name: ________________________

(Insert Authorized User Entity Name Above)

Address: As set forth in Authorized User’s Account

Contact: As set forth in Authorized User’s Account

Key Contact: The Designated Representative set forth in Authorized User’s Account

Data Importer:

Name: VOEDX Marketplace, LLC

Address: 4 May Hill Lane, Dix Hills, NY 11746

Contact: privacy@voedx.com

Key Contact: Privacy Officer, privacy@voedx.com

TABLE 2: SELECTED SCCs, MODULES AND SELECTED CLAUSES

Addendum EU SCCs: The version of the Approved EU SCCs which the UK Addendum is appended to, as set out in Annex B (EU Standard Contractual Clauses approved by Commission Implementing Decision (EU) 2021/914 of 4 June 2021).

Selected Module: Module 3 (Processor to Processor)

TABLE 3: APPENDIX INFORMATION

Annex 1A - List of Parties: See Annex B, Appendix I.A of this DPA

Annex 1B - Description of Transfer: See Annex B, Appendix I.B of this DPA

Annex II - Technical and Organisational Measures: See Annex B, Appendix II of this DPA

Annex III - List of Sub-Processors: See Annex B, Appendix III of this DPA

TABLE 4: ENDING THIS ADDENDUM WHEN THE APPROVED ADDENDUM CHANGES

Ending this Addendum when the Approved Addendum changes:

Which Parties may end this Addendum as set out in Section 19 of the UK Addendum:

☐ Importer

☐ Exporter

☒ Either Party

NOTES FOR TABLE 4: