Data Processing Agreement

---

Data Processing Agreement:

This Data Processing Agreement ("Agreement") is entered into by and between MWAI-Tech ("Data Processor") and you, ("Data Controller") (collectively, the "Parties").

1. Definitions:

In this Agreement, the following terms shall have the meanings set forth below:

1.1 "Data Protection Laws" means all applicable laws and regulations relating to the processing of personal data, including the General Data Protection Regulation (GDPR) and the Data Protection Act 2018.

1.2 "Personal Data" means any information relating to an identified or identifiable natural person.

1.3 "Processing" means any operation or set of operations which is performed on Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

1.4 "Standard Contractual Clauses" means the standard contractual clauses for the transfer of personal data to processors established in third countries, as approved by the European Commission.

2. Processing of Personal Data

2.1 The Data Processor shall process Personal Data on behalf of the Data Controller for the purposes of providing the services under the agreement between the Parties.

2.2 The Data Processor shall process Personal Data only in accordance with the documented instructions of the Data Controller, unless required to do so by applicable law.

2.3 The Data Processor shall ensure that all personnel who have access to Personal Data are subject to appropriate confidentiality obligations.

2.4 The Data Processor shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk presented by the processing of Personal Data.

3. Transfer of Personal Data

3.1 The Data Processor may transfer Personal Data to countries outside the European Economic Area (EEA) or the UK only in accordance with the Standard Contractual Clauses.

3.2 The Data Processor shall notify the Data Controller promptly if it receives a request from a data subject to exercise their rights under the Data Protection Laws.

4. Sub-Processors

4.1 The Data Processor may engage sub-processors to process Personal Data on behalf of the Data Controller, provided that the Data Processor enters into a written agreement with the sub-processor that imposes the same data protection