VEXPLOR Logic Studio — Data Processing Addendum

Preamble

This Data Processing Addendum ("DPA") is entered into between WACE Inc. (주식회사 웨이스), a company incorporated in the Republic of Korea with its principal office at 150 Dongtanyeongcheon-ro, Building A, Units 1332–1335, Dongtan-gu, Hwaseong-si, Gyeonggi-do 18462, Republic of Korea ("WACE"), and the customer identified in the signature block ("Customer"). It forms part of the agreement under which WACE provides VEXPLOR Logic Studio (the "Service") to Customer, being either (a) the Microsoft Marketplace Standard Contract as amended by WACE's Universal amendment, together with the Service-Specific Terms, or (b) a written agreement signed directly by WACE and Customer (in each case, the "Agreement").

1. Definitions

1.1 "Applicable Data Protection Law" means all laws on the protection of personal information that apply to a party's processing of Customer Personal Data under the Agreement, including, where applicable, the California Consumer Privacy Act as amended (Cal. Civ. Code §1798.100 et seq.) and its regulations (11 CCR §7000 et seq.) (together, the "CCPA"), the Virginia Consumer Data Protection Act, the Colorado Privacy Act, the Texas Data Privacy and Security Act and similar U.S. state laws, Japan's Act on the Protection of Personal Information ("APPI"), Thailand's Personal Data Protection Act B.E. 2562 ("PDPA"), and Korea's Personal Information Protection Act ("PIPA").

1.2 "Customer Personal Data" means personal information that WACE processes on behalf of Customer in providing the Service, as described in Annex A. It does not include WACE Account Data.

1.3 "WACE Account Data" means personal information that WACE collects for its own relationship with Customer and prospective customers and that WACE handles as an independent controller under its privacy policy: (a) purchaser and beneficiary contact details and subscription information that Microsoft sends to WACE for a Marketplace order; (b) trial workspace requests submitted to WACE; and (c) correspondence sent directly to WACE outside the Service.

1.4 "Authorized User" means an individual to whom Customer gives an account in the Service.

1.5 "Handler Account" means (a) an account of WACE personnel who operate the Service, and (b) a Customer account that handles business data in the Service, namely accounts with the owner, admin or user role and sign-ins with an on-site PIN. Accounts with the view-only viewer role are not Handler Accounts.

1.6 "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data.

1.7 "Sub-processor" means a third party that WACE engages to process Customer Personal Data.

1.8 Terms such as "controller", "processor", "business", "service provider", "consumer", "sell" and "share" have the meanings given in Applicable Data Protection Law.

2. Roles and purposes

2.1 Customer as controller. For Customer Personal Data, Customer is the controller (and the "business" under the CCPA, or the "personal information handling business operator" under the APPI), and WACE is the processor (and the "service provider" under the CCPA). Customer decides what personal information is stored in the Service and is responsible for having a lawful basis for it.

2.2 Processing on instructions. WACE processes Customer Personal Data only on Customer's documented instructions. This DPA, the Agreement, Annex A and Customer's configuration of the Service are Customer's complete instructions at the date of signature. Customer instructs WACE to process Customer Personal Data to provide, maintain and support the Service, including authenticating Authorized Users, enforcing access controls and keeping the records described in Annex A.

2.3 Permitted WACE Purposes. In addition, WACE may use Customer Personal Data only for the following two purposes, and only to the extent necessary for them:

• (a) Security — detecting, preventing and investigating security incidents, unauthorized access and fraudulent or illegal activity affecting the Service, including across customers; and
• (b) Billing — administering Customer's subscription and checking usage against Customer's plan using counts that do not identify any individual (accounts, records, storage and requests), and only if Customer has agreed to such counts at activation; otherwise the plan scope is confirmed by documents Customer provides.

2.4 Retention required by law. Nothing in this DPA requires WACE to delete Customer Personal Data where retention is required by applicable law. This exception covers only (a) access records of Handler Accounts and (b) records of the granting, changing and revoking of access permissions, in each case for the periods stated in Annex A. Such records are kept and destroyed as set out in Sections 10.2 to 10.4.

2.5 No other use. WACE does not use Customer Personal Data to train artificial intelligence models, for advertising, or to build profiles of individuals.

2.6 Unlawful instructions. WACE informs Customer without undue delay if, in its opinion, an instruction infringes Applicable Data Protection Law, and may suspend the affected processing until the instruction is confirmed or changed.

3. Customer obligations

3.1 Customer shall not store sensitive personal information in the Service (for example health, biometric, racial or ethnic origin, religious, union membership or government identification numbers). The Service is not designed for it.

3.2 Customer is responsible for notices to, and consents from, its Authorized Users and other individuals whose personal information it stores, including any notice or consent required for transfer of personal information to WACE in the Republic of Korea.

3.3 Customer may instruct WACE to keep sign-in and security event records of Authorized Users who are not Handler Accounts for a shorter period than the default in Annex A, but not shorter than 90 days. Such an instruction takes effect no earlier than 31 October 2026. Customer gives this instruction in writing to the notice address in Section 18.3 or, when available, in the Service settings. WACE applies it within 30 days.

4. Restrictions (all Customers)

WACE shall not:

• (a) sell or share Customer Personal Data;
• (b) retain, use or disclose Customer Personal Data for any purpose other than the purposes in Sections 2.2 and 2.3 and Annex A, including for any commercial purpose other than providing the Service;
• (c) retain, use or disclose Customer Personal Data outside the direct business relationship between WACE and Customer; or
• (d) combine Customer Personal Data with personal information that WACE receives from or on behalf of another person, or collects from its own interaction with an individual, except as permitted for service providers by 11 CCR §7050 and only for the Permitted WACE Purposes.

5. Confidentiality of personnel

WACE ensures that each person authorized to process Customer Personal Data is subject to a written or statutory duty of confidentiality, and that access is limited to personnel who need it to perform the Agreement.

6. Security

WACE implements and maintains the technical and organizational measures described in Annex B. WACE may update Annex B, provided the overall level of protection does not decrease.

7. Sub-processors

7.1 Current list. Customer authorizes the Sub-processors listed in Annex C. Annex C is also published at https://vexplor.com/en/subprocessors/logic-studio. For Marketplace orders, Customer also gives this authorization by ticking the sub-processor box on the activation screen, and WACE keeps a record of that confirmation.

7.2 New Sub-processors. WACE notifies Customer's notice contact by email at least 30 days before adding or replacing a Sub-processor, including any provider of AI model services. The notice states the Sub-processor's name, location, the processing it will perform and the data involved. Where a new Sub-processor is used only for a feature that Customer chooses to turn on, Customer's act of turning on that feature, after being shown this information, is its authorization.

7.3 Objection. Customer may object on reasonable data protection grounds within the 30-day notice period. Silence is not consent where Applicable Data Protection Law requires consent. The parties will discuss the objection in good faith. If WACE cannot apply the change without using the new Sub-processor for Customer's data and the objection is not resolved, Customer may terminate the affected subscription without penalty before the change takes effect. WACE then requests Microsoft to refund prepaid fees for the unused period (for Marketplace orders) or refunds them directly (for direct agreements), and Section 10 applies.

7.4 Flow-down and responsibility. WACE engages each Sub-processor under a written contract that imposes data protection obligations no less protective than this DPA. WACE remains responsible to Customer for its Sub-processors' performance.

8. Assistance

8.1 Individual requests. If WACE receives a request from an individual about Customer Personal Data, WACE forwards it to Customer and does not respond except to confirm receipt and refer the individual to Customer, unless Customer instructs otherwise or law requires.

8.2 Help with requests. At Customer's written request, WACE (a) exports the account, sign-in, security event and support records of a named Authorized User in a machine-readable format (JSON), and (b) deletes a named Authorized User's account, keeping only the records described in Section 2.4, separately from other information, for the rest of their retention period. WACE completes each request within 10 days of receiving it and confirms completion to Customer in writing.

8.3 Other assistance. Taking into account the nature of the processing and the information available to it, WACE gives Customer reasonable information and help for Customer's risk or impact assessments, consultations with authorities and other obligations under Applicable Data Protection Law that concern the Service.

9. Personal Data Breach

9.1 WACE notifies Customer's notice contact without undue delay, and in any event within 48 hours after becoming aware of a Personal Data Breach. The notice describes, to the extent then known, the nature of the breach, the categories and approximate number of individuals and records concerned, the likely consequences, the measures taken or proposed, and a contact point at WACE. WACE provides further information in phases as it becomes available.

9.2 WACE takes reasonable steps to contain and remedy the breach and cooperates with Customer's notifications to authorities and individuals. Customer decides whether and how to notify individuals and authorities, except where law requires WACE itself to notify.

9.3 As a processor established in the Republic of Korea, WACE may be required by Korean law to report a breach to Korean authorities. Where lawful, WACE informs Customer before or at the time of making such a report.

9.4 A notice under this Section is not an admission of fault or liability.

10. Return and deletion

10.1 When a subscription ends, WACE keeps Customer Personal Data for 30 days from the later of the subscription end date and the date WACE receives Microsoft's cancellation notice (for direct agreements, from the end date) (the "Retention Period"), and longer until a return Customer requested within that period is complete.

10.2 When the Agreement ends, WACE returns Customer Personal Data during the return period (30 days) and destroys it within 5 days thereafter. However, the access records of personal information handlers and the records of the granting, changing and revoking of access permissions that applicable law requires to be retained are included in the returned data. WACE keeps its copy of those records separately from other information, solely for security and legal compliance purposes, until the end of each retention period (access records 1 year and permission records 3 years, counted from the date each record was created), and then destroys them without delay. WACE does not use that copy for any other purpose or provide it to any third party. In this Section 10, the "return period" is the Retention Period in Section 10.1.

10.3 Returned data is provided in a usable format. WACE destroys Customer Personal Data so that it cannot be restored, records the date, items and method of destruction, and confirms destruction to Customer on request. Backup copies expire within 7 days after destruction, and WACE does not restore destroyed data from them. All business data and the sign-in and security event records of Authorized Users who are not Handler Accounts (Annex A, row 6) are destroyed and not retained. The copy WACE keeps under Section 10.2 is not pseudonymized; it is stored separately from other data, encrypted, accessible only to the minimum personnel needed, and every access to it is logged.

10.4 If Customer instructs WACE to destroy all Customer Personal Data without exception, WACE destroys everything else as instructed and informs Customer in writing of the legal reason for keeping the records described in Section 10.2 and the date on which each will be destroyed.

10.5 WACE's operator audit records (Annex A, row 8) are WACE's own records. They are kept separately for up to 3 years under Annex A, independently of the destruction of Customer Personal Data.

11. Information, reports and assessments

11.1 Annual written report. At least once every 12 months, and on Customer's reasonable request, WACE provides a written report describing the security measures in Annex B, any changes since the previous report, the current Sub-processor list and any Personal Data Breach affecting Customer in the period.

11.2 Reasonable assessments. WACE allows and contributes to reasonable assessments by Customer or an assessor it appoints that is bound by confidentiality. An assessment may consist of written questionnaires, review of documents and records, and a remote review notified in advance. Customer may conduct one assessment in any 12-month period on at least 30 days' written notice, and additional assessments where required by an authority or after a Personal Data Breach affecting Customer. Assessments are at Customer's cost, take place during business hours in the Republic of Korea, avoid unreasonable disruption, and do not include access to other customers' data or to Sub-processors' facilities; for Sub-processors, WACE provides their published third-party audit reports instead. If an assessment finds a material breach of this DPA by WACE, WACE bears its own costs of remediation. On-site visits take place only by mutual agreement or where an authority requires them.

11.3 Independent assessment report. If WACE holds a report from a qualified and independent assessor covering the Service (for example a SOC 2 report or ISO/IEC 27001 certification), WACE makes it available to Customer under confidentiality. As of the version date of this DPA, WACE does not hold such a report.

11.4 Customer's election. Customer selects in the signature block (Election 1) how Sections 11.1 to 11.3 apply. If Customer has not selected an option, option (A) applies. Customer's consent to option (C) is given only by ticking that option; it is not inferred from signature.

12. Records of processing

WACE maintains a written record of the processing activities it carries out on behalf of Customer, and makes it available to Customer or a competent authority on request.

13. Data location and international transfers

13.1 Storage. Customer Personal Data is stored in Microsoft Azure, Korea Central region, in the Republic of Korea. Backups are stored in the same region.

13.2 Remote access. WACE personnel access Customer Personal Data from the Republic of Korea. Microsoft Corporation (United States) operates the cloud infrastructure as WACE's Sub-processor, and its personnel may be able to access data remotely, including from outside the Republic of Korea, where needed to provide or secure the cloud service. Access is limited to the purposes in this DPA.

13.3 Country annexes. Annex US applies where the CCPA or a U.S. state privacy law applies. Annex JP applies where the APPI applies. Annex TH applies where the PDPA applies. This DPA contains no annex for any other country; where another country's law requires specific transfer terms, the parties will agree them in writing before Customer Personal Data subject to that law is processed.

13.4 Customer's transfer obligations. Customer is responsible for any filing, assessment, notice or consent that Applicable Data Protection Law requires for transferring Customer Personal Data to WACE. WACE provides the information about its processing that Customer reasonably needs within 15 business days of a written request.

14. Notice of inability to comply

WACE notifies Customer within 5 business days if it determines that it can no longer meet its obligations under this DPA or Applicable Data Protection Law. Customer may then take reasonable and appropriate steps to stop and remediate unauthorized processing, including suspending the transfer of Customer Personal Data or terminating the affected subscription.

15. Liability

Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Agreement. For Marketplace orders, the limit for unauthorized access to, or use or disclosure of, Customer Data in Section 9 of WACE's Universal amendment applies.

16. Governing law and disputes

16.1 This DPA is governed by the laws of the Republic of Korea, without affecting the mandatory application of Applicable Data Protection Law or the powers of any competent data protection authority.

16.2 Unless Customer has elected arbitration in the signature block (Election 2), any dispute arising out of this DPA shall be brought in the competent court of the place where the defendant has its principal place of business. This choice of court is non-exclusive and does not prevent either party from bringing proceedings in any other court that has jurisdiction under applicable law.

16.3 If Customer has elected arbitration, any dispute arising out of or in connection with this DPA shall be finally settled by arbitration administered by the Korean Commercial Arbitration Board under its International Arbitration Rules, by one arbitrator, seated in Seoul, Republic of Korea, and conducted in English. Either party may seek interim relief from a competent court.

16.4 For Marketplace orders, this Section applies to disputes under this DPA. Any dispute under the Standard Contract is governed by the Standard Contract as amended by WACE's Universal amendment.

17. Order of precedence and language

17.1 For the processing of Customer Personal Data, this DPA prevails over the Agreement. A country annex prevails over the body of this DPA for processing subject to that country's law. Mandatory requirements of Applicable Data Protection Law prevail over both.

17.2 This DPA is made in English. For Customers located outside the Republic of Korea, the English version controls. Any translation is provided for convenience only.

18. Term, changes and notices

18.1 This DPA applies for as long as WACE processes Customer Personal Data under the Agreement.

18.2 For Marketplace orders, the version of this DPA in effect on the date of the order applies until the end of the then-current subscription term. If a new version will apply from a renewal, WACE emails Customer's notice contact at least 30 days before that renewal. WACE does not change this DPA during a subscription term without Customer's written agreement, except to update Annex C under Section 7 or Annex B under Section 6.

18.3 Customer's notice contact is the email address Customer registers in the Service; if none is registered, the email of the owner account. WACE's notice address is contact@wace.me.

Signing this DPA

To sign this DPA, Customer emails contact@wace.me. WACE sends a signature copy with the signature block for both parties (for WACE: WACE Inc., signed by Dong Gul Bang, Chief Executive Officer; notice address contact@wace.me) and the two elections below.

Election 1 — Information and assessments (Section 11). Customer selects one:

• (A) Annual written report (Section 11.1), plus reasonable assessments at Customer's cost (Section 11.2). (Applies if nothing is selected.)
• (B) Annual written report only. Customer may still request an assessment under Section 11.2 where required by an authority or after a Personal Data Breach affecting Customer.
• (C) Customer consents to WACE providing a report of a qualified and independent assessor, when WACE holds one, in place of the assessment in Section 11.2, for the purposes of the Colorado Privacy Act and similar state laws. Until WACE holds such a report, option (A) applies.

Election 2 — Disputes (Section 16). Customer selects one:

• Courts of the defendant's principal place of business, non-exclusive (Section 16.2). (Applies if nothing is selected.)
• Arbitration seated in Seoul under the KCAB International Arbitration Rules (Section 16.3).

Annex A — Details of processing

Subject matter and nature. Hosting, storage, retrieval, display, search, notification, authentication, access control, backup, support and deletion of data in the Service, a multi-tenant manufacturing operations application.

Duration. The term of the Agreement plus the Retention Period, and the retention periods in the table below.

Frequency. Continuous.

Categories of individuals. (a) Customer's employees, contractors and other Authorized Users; (b) individuals whose personal information appears in business records Customer stores (for example employees named in work orders or quality records, and contact persons of Customer's suppliers and customers).

Sensitive data. None intended (Section 3.1).

• 1. Business records — Personal information: Whatever Customer enters or connects, for example employee names in work orders, quality and production records; supplier and customer contact persons; Purpose (instruction): Store, display, search and process records as Customer configures the Service; Retention: Subscription term + Retention Period (Section 10)
• 2. Account data — Personal information: Email, name, role (owner, admin, user, viewer), department code and employee number if Customer sets them, account language, time zone; password and PIN stored only as one-way (scrypt) hashes; two-step verification secret (TOTP) if enabled; Purpose (instruction): Authenticate Authorized Users and enforce role-based access; Retention: Until Customer deletes the account, or subscription term + Retention Period. Two-step verification secret: until it is turned off or reset, or the account is deleted
• 3. Session records — Personal information: Hash of the session token, IP address, browser information (user agent); Purpose (instruction): Keep users signed in; detect session misuse; Retention: 7 days after the session ends
• 4. Usage records — Personal information: Screens opened and how they were reached (menu, search, favorites), favorites, recently used screens, in-app notifications; support board posts (author email and name, title, message, screen address); Purpose (instruction): Run the Service features Customer uses; answer support requests; Retention: Subscription term + Retention Period
• 5. Access records of Handler Accounts — Personal information: Sign-in time, IP address, user agent, device value (derived from browser type and IP range), sign-in method, failed sign-in count, lock time; security events (password change and reset, two-step verification on, off and reset, new-device sign-in, sign-out of other sessions); Purpose (instruction): Security (Section 2.3(a)); retention required by law (Section 2.4); Retention: 1 year, fixed (deleted by a daily job)
• 6. Sign-in and security event records of other Authorized Users — Personal information: Same items as row 5; Purpose (instruction): Security (Section 2.3(a)); support Customer's own access-record obligations; Retention: 1 year by default; from 31 October 2026 Customer may instruct a shorter period of not less than 90 days (Section 3.3)
• 7. Access-permission records (user management records) — Personal information: Email of the person who acted, email of the affected user, action (add, role change, suspend, re-enable, administrator password reset, administrator handover, two-step verification reset, unlock), time, reason for a handover; Purpose (instruction): Retention required by law (Section 2.4); make the records available to Customer administrators; Retention: 3 years
• 8. WACE operator audit records — Personal information: Identity of the WACE operator, action, time, target record identifier, reason where required; Purpose (instruction): Security (Section 2.3(a)); Retention: Up to 3 years; records relating to an ongoing incident investigation or dispute are kept until it ends
• 9. Password reset requests — Personal information: Hash of the reset token, requesting IP address; Purpose (instruction): Let users reset passwords; Retention: Usable for 30 minutes; deleted automatically after 1 day
• 10. Usage counts — Personal information: Non-identifying counts of accounts, records, storage and requests per customer; Purpose (instruction): Billing (Section 2.3(b)), only with Customer's agreement at activation; Retention: Subscription term + Retention Period

Rows 5 and 6 are kept in separate tables with separate settings. Changing the setting for row 6 does not change row 5.

When a subscription ends, rows 1 to 4, 6, 9 and 10 are destroyed under Section 10. Rows 5 and 7 are included in the returned data, and WACE keeps a separate copy only until 1 year (row 5) or 3 years (row 7) from the creation of each record (Sections 10.2 to 10.4). Row 8 is WACE's own record and is kept separately for up to 3 years (Section 10.5).

Annex B — Technical and organizational security measures

• 1. Encryption in transit. All traffic to the Service uses HTTPS (TLS).
• 2. Encryption at rest. Data and backups are stored in Azure Database for PostgreSQL with the storage encryption provided by the Azure platform.
• 3. Customer separation. Database row-level security on every table. A user of one customer cannot read or change another customer's rows; the database refuses the request. The application connects with a database role that cannot bypass row-level security. This is tested automatically on every deployment.
• 4. Credentials. Passwords, PINs, session tokens, password-reset tokens and welcome-link tokens are stored only as one-way hashes.
• 5. Authentication controls. Accounts are locked temporarily after repeated failed sign-ins (per account and IP address). Users may turn on two-step verification with an authenticator app. Users receive email alerts for sign-ins from a new device and for password changes. Users can sign out other sessions.
• 6. Role-based access. Customer administrators assign roles (owner, admin, user, viewer). Changes to accounts and roles are recorded (Annex A, row 7) and visible to Customer administrators.
• 7. WACE personnel access. Access to production systems is limited to WACE personnel who need it. WACE operators use a separate operator console; operator actions, including opening records that contain personal information, are recorded in the operator audit log (Annex A, row 8). WACE operators may use two-step verification.
• 8. Logging. Access records of Handler Accounts are kept for 1 year and access-permission records for 3 years (Annex A).
• 9. Backup and availability. Automatic backups are kept for 7 days in the Korea Central region. The Service runs on one application server and one database server without high availability or geo-redundant backup (Universal amendment Section 4).
• 10. Deletion. Data is deleted from the production database so that it cannot be restored; backups expire within 7 days of deletion. Deletion jobs record their schedule and results; tenant deletion produces a deletion record. Records kept under Section 10.2 are stored separately, encrypted, accessible to the minimum personnel needed, with every access logged.
• 11. AI models. The Service does not currently send Customer Personal Data to any AI model service. Before any AI model provider is used, Section 7 applies and the provider is listed in Annex C.
• 12. Incident response. WACE maintains a written incident response procedure that meets the 48-hour notice in Section 9.
• 13. Personnel. Personnel with access are bound by confidentiality (Section 5) and are instructed on this DPA.
• 14. Review. WACE reviews these measures at least once a year and reports on them under Section 11.1.

Annex C — Sub-processors

• Microsoft Corporation, One Microsoft Way, Redmond, WA 98052, United States — Location of entity: United States; Processing: Cloud hosting of the application and the managed PostgreSQL database, storage and backup (Azure App Service, Azure Database for PostgreSQL); Location of data: Azure Korea Central region, Republic of Korea; remote access as described in Section 13.2; Data: All Customer Personal Data
• Sub-processors that Microsoft lists for Azure in its published Azure sub-processor list — Location of entity: As listed by Microsoft; Processing: Support of the Azure services above; Location of data: As listed by Microsoft; Data: As listed by Microsoft

Not Sub-processors (for information).

• Google LLC (Google Analytics 4) processes visit statistics only on the pre-login introduction pages and only with the visitor's consent. It receives no Customer Personal Data.
• Microsoft Corporation as identity provider for "Sign in with Microsoft": when an Authorized User chooses this method, Microsoft sends WACE the sign-in result. WACE does not send Customer Personal Data to Microsoft for this sign-in.
• Service emails (security alerts, password resets, welcome emails) are sent from no-reply@vexplor.com through a mail server WACE operates. No third party is involved.
• No AI model provider is used.

Annex US — United States

• 1. Application. This Annex applies to Customer Personal Data that is subject to the CCPA or to the Virginia, Colorado or Texas privacy laws or a similar U.S. state law, to the extent that law applies.
• 2. CCPA service provider terms. To the extent Customer is a "business" under the CCPA:
• (a) The specific business purposes for which WACE processes Customer Personal Data are those listed in Annex A and Section 2.3: hosting and operating the Service for Customer; authenticating Customer's Authorized Users and enforcing access controls; customer support requested by Customer; security monitoring and incident response; and billing using non-identifying counts.
• (b) WACE shall not sell or share Customer Personal Data, and shall not retain, use or disclose it for any other purpose, for any commercial purpose other than those business purposes, or outside the direct business relationship with Customer (Section 4).
• (c) WACE shall not combine Customer Personal Data with other personal information except as permitted by 11 CCR §7050 (Section 4(d)).
• (d) WACE shall comply with applicable obligations under the CCPA and provide the same level of privacy protection the CCPA requires of businesses.
• (e) Customer may take reasonable and appropriate steps to ensure WACE uses Customer Personal Data consistently with Customer's CCPA obligations, including the reports and assessments in Section 11, at least once every 12 months.
• (f) WACE notifies Customer within 5 business days if it can no longer meet its CCPA obligations (Section 14).
• (g) Upon notice, Customer may take reasonable and appropriate steps to stop and remediate unauthorized use (Section 14).
• (h) WACE assists Customer in responding to consumer requests as set out in Section 8.
• (i) WACE requires each Sub-processor to meet the obligations in this paragraph by written contract (Section 7.4).

WACE certifies that it understands and will comply with the restrictions in this paragraph.

• 3. State processor terms. To the extent the Virginia, Colorado or Texas privacy law or a similar state law applies:
• (a) Annex A sets out the instructions, nature and purpose of processing, types of data, and duration of processing;
• (b) each person processing Customer Personal Data is subject to a duty of confidentiality (Section 5);
• (c) at Customer's direction, WACE deletes or returns Customer Personal Data at the end of the services, unless retention is required by law (Sections 2.4 and 10);
• (d) WACE makes available all information in its possession necessary to demonstrate compliance (Section 11.1);
• (e) WACE allows and cooperates with reasonable assessments by Customer or its designated assessor (Section 11.2), or, only where Customer has selected option (C) in Election 1, provides a report of a qualified and independent assessor;
• (f) WACE engages Sub-processors only under written contracts that require them to meet WACE's obligations, and gives Customer notice and an opportunity to object before engaging a new one (Section 7);
• (g) WACE assists Customer with consumer requests, security of processing, breach notification and data protection assessments (Sections 6, 8 and 9);
• (h) Annex B describes the security measures that WACE implements.
• 4. Employee and business-contact data. The parties acknowledge that some state laws exclude individuals acting in a commercial or employment context from their definition of "consumer". This Annex applies only to the extent the relevant law applies.

Annex JP — Japan

• 1. Application. This Annex applies to personal data subject to the APPI that Customer provides to WACE.
• 2. Equivalent measures. WACE is located in the Republic of Korea. For such personal data, WACE shall continuously implement measures equivalent to those required of a personal information handling business operator under Chapter 4 of the APPI, including:
• (a) use only for the purposes in Annex A and Section 2.3;
• (b) the security control measures in Annex B;
• (c) supervision of its personnel (Section 5);
• (d) no provision to third parties other than Sub-processors bound by equivalent terms. Customer acknowledges that Microsoft Corporation, located in the United States, is a Sub-processor and handles the personal data as described in Section 13.2 and Annex C, and WACE requires Microsoft to apply equivalent measures by contract;
• (e) notice to Customer without undue delay, and in any event within 48 hours, of any leakage, loss or damage (Section 9), so that Customer can make reports and notices under Article 26 of the APPI;
• (f) return or deletion at the end of the Agreement (Section 10);
• (g) assistance with requests from individuals (Section 8).
• 3. Customer's periodic confirmation. WACE provides the annual written report in Section 11.1, which describes the implementation of the measures in paragraph 2 and any circumstance in the Republic of Korea or the United States that may affect them, so that Customer can take the measures required by Article 28(3) of the APPI. WACE promptly informs Customer of any change in Korean law or other circumstances that may prevent WACE from continuing the measures in paragraph 2.
• 4. Information about Korea. WACE provides Customer, on request and in any event at signature, a description of the Korean personal information protection system and of WACE's measures (in Japanese), for Customer's use under Articles 28(2), 28(3) and 32 of the APPI.
• 5. Handling methods. Annex A specifies the methods of handling personal data, and Section 11 sets out the measures by which Customer monitors WACE's handling. As part of these methods, after the Agreement ends WACE keeps only the access records of personal information handlers (until 1 year from creation) and the records of the granting, changing and revoking of access permissions (until 3 years from creation), separately and solely for security and legal compliance purposes, and then destroys them without delay (Sections 10.2 to 10.4). These records are also included in the data returned to Customer.
• 6. Suspension. If WACE cannot continue the measures in paragraph 2, it informs Customer, and Customer may suspend the provision of personal data to WACE and terminate the affected subscription.

Annex TH — Thailand

• 1. Application. This Annex applies to personal data subject to the PDPA.
• 2. Processor obligations (Section 40 PDPA). WACE shall:
• (a) collect, use or disclose personal data only on Customer's instructions, except where required by law;
• (b) maintain appropriate security measures to prevent unauthorized or unlawful loss, access, use, alteration, correction or disclosure (Annex B);
• (c) notify Customer of any personal data breach without undue delay and within 48 hours, so that Customer can meet its 72-hour obligation under Section 37(4) of the PDPA (Section 9);
• (d) prepare and keep records of processing activities (Section 12).
• 3. Agreement. The parties intend this DPA to be the agreement between controller and processor required by Section 40 of the PDPA.
• 4. Transfer to the Republic of Korea. The parties intend the commitments in this DPA, including Sections 4 to 12, to serve as appropriate safeguards for the transfer of personal data to WACE in the Republic of Korea within the meaning of Section 29 of the PDPA, subject to any rules the Personal Data Protection Committee issues. If those rules require further terms, the parties will agree them in writing.
• 5. Retention review. WACE maintains a system to delete personal data when its retention period ends (Annex A and Section 10).
• 6. Return and destruction. When the Agreement ends, WACE returns Customer Personal Data during the return period (30 days) and destroys it within 5 days thereafter. However, the access records of personal information handlers and the records of the granting, changing and revoking of access permissions that applicable law requires to be retained are included in the returned data. WACE keeps its copy of those records separately from other information, solely for security and legal compliance purposes, until the end of each retention period (access records 1 year and permission records 3 years, counted from the date each record was created), and then destroys them without delay. WACE does not use that copy for any other purpose or provide it to any third party.