Data Transfer Addendum (DTA)

This DTA is incorporated into the Agreement between G2 and Customer. Undefined capitalized terms have the meanings in the Agreement or applicable data protection laws (“Privacy Laws”), including equivalent terminology. Each party will comply with Privacy Laws.

1. Scope. This DTA governs Personal Data G2 transfers to Customer, each an Independent Controller, as follows:

Customer is solely responsible for its Processing, and must promptly notify legal@g2.com of any inability to comply with this DTA or if there are additional legal requirements. In the case of noncompliance, Customer must cease affected Processing, and allow G2 to suspend all or part of the Services without penalty. Customer must not sell or share Personal Data, use it for cross-context behavioral advertising, combine it with unrelated data, use it incompatibly, or aggregate, deidentify or anonymize it. For Personal Data subject to the California Consumer Privacy Act (“CCPA”), Customer acts as a third party and must: (a) use Personal Data only for the limited purposes in the Agreement and this DTA, (b) provide the level of protection required by the CCPA, (c) honor opt-out or restriction instructions from G2, and (d) allow G2 to take reasonable steps to verify compliance, and to stop and remediate unauthorized use.

Customer must maintain, at its expense, risk-appropriate safeguards for the Personal Data, before receipt and throughout Processing. Customer must notify security@g2.com without undue delay upon awareness of a Personal Data breach, providing available details of the nature of the incident, timing, affected data and individuals, likely affects, mitigation, and contact information that G2 can use to get more information from Customer about the breach, and prompt updates. Customer must contain and remediate the breach, preserve evidence, assist G2, and reimburse G2’s reasonable investigation, response, and notification costs.

Each party must handle requests relating to its Processing and reasonably assist the other. Customer must promptly forward requests concerning G2’s Processing to privacy@g2.com and assist with meeting applicable deadlines.

International transfer must use a lawful mechanism, and comply as follows:

5.1. Data Privacy Framework (“DPF”). Where applicable, transfers rely on the EU-U.S. DPF, its UK Extension, and the Swiss-U.S. DPF.

5.2. EU Transfers. If EU DPF does not apply, the parties incorporate and agree to EU’s Standard Contractual Clauses (“EU SCCs”) as follows:

5.3. Swiss Transfers. If Swiss-U.S. DPF does not apply, EU SCCs apply, substituted for Swiss Federal Act on Data Protection references, Swiss Federal Data Protection and Information Commissioner under Annex I.C, and Switzerland under Clauses 17 and 18.

5.4. UK Transfers. If the UK Extension does not apply, the parties incorporate and agree to the UK International Data Transfer Addendum to the EU SCCs as follows:

5.5. Other Transfers. Other restricted transfers require a mechanism permitted by Privacy Laws.

Customer must securely delete Personal Data when no longer needed for permitted purposes or the Service ends, unless law requires retention. Retained data remains protected by this DTA and may be used only for the required retention purpose. On request, Customer must confirm deletion in writing.

The following order of precedence applies to interpretation of this DTA: (a) mandatory requirements of Privacy Laws, (b) this DTA, and (c) the Agreement. G2 may update this DTA, but will not materially reduce protections.

This DTA begins on the Effective Date and continues until the earlier of the termination of the Agreement or Customer’s Processing of Personal Data.