June 1 2020

Coca-Cola Beverages Philippines, Inc.

Company

-and-

All Asian Countertrade, Inc.

Provider

MASTER SUPPLY AGREEMENT

Classified as Confidential. Please do not forward this to unintended users. Otherwise, request necessary permission.
 JUNE 1, 2020:

(1) Coca-Cola Beverages Philippines, Inc. ("Company"); and

(2) All Asian Countertrade, Inc. ("Provider").

(3) Company and Provider are hereinafter referred to as “Party” or the “Parties”;

RECITALS

Company wishes to enter into an agreement with Provider to provide certain Services/Goods (as
defined below and its attachments).

The parties wish to document the terms and conditions upon which the Services/Goods are to be
performed and/or provided in this agreement.

1. TERM AND TERMINATION

1.1 Subject to the terms and conditions hereof, this Agreement will become effective on June 1,
2020 and will continue in force until September 30, 2020. Time is of the essence for the
completion of the work described in this contract. It is anticipated by the parties that all work
described herein will be completed within the agreed period, and that any delay in the
completion of the work described herein shall constitute a material breach of this contract
and shall not require a formal demand for obligation to become due.

1.2 Subject to the specific engagement termination rights, if any, described in each applicable
Statement of Work, this Agreement may be terminated:

1.2.1 For Convenience. Either party may terminate this Agreement and/or one or more
Engagements upon thirty (30) days’ written notice to the other, which notice shall specify the effective
date of such termination. On the issuance of such notice by either party, at Company’s sole election
Provider shall either require the continued provision of Services until the effective date of termination,
or may pay any or all amounts that would otherwise accrue due to Provider during the notice period
and terminate the Agreement or the applicable Engagement immediately.

1.2.2 For Default. If a party fails to cure any material breach of its obligations hereunder (or
pursuant to an applicable Statement of Work) within ten (10) days after its receipt of written notice
thereof from the other party, then the other party may terminate this Agreement and/or the applicable
Engagement at any time thereafter by providing the defaulting party with written notice of termination.

1.2.3 Automatically. This Agreement terminates automatically, with no further action by either
party, if: (i) a receiver is appointed for either party or its property; (ii) either party makes an assignment
for the benefit of its creditors; (iii) any proceedings are commenced by, for, or against either party
under any bankruptcy, insolvency, or debtor’s relief law for the purpose of seeking a reorganization of
such party’s debts, and such proceeding is not dismissed within sixty (60) calendar days of its
commencement and (iv) either party is liquidated or dissolved.

1.2.4 Expiration of Term. All Engagements terminate automatically and without further notice
upon expiration of the term of this Agreement.

Classified as Confidential. Please do not forward this to unintended users. Otherwise, request necessary permission.
 1.3 In the event of termination of this Agreement and/or any Engagement( s) for any reason, on
the effective date of such termination:

1.3.1 Provider shall cease providing any and all Services relating to the terminated
Engagement(s); and

1.3.2 Provider shall, not later than three (3) days after such termination, at its own cost and
without request surrender and deliver to Company all materials containing, embodying or otherwise
evidencing any Confidential Information (including all Product), regardless of whether any such item
or the information therein was prepared, produced or authored by Provider and forthwith refund to the
Company all moneys paid in advance where services have not been rendered at Date of Termination.

1.4 In the event of termination of this Agreement for any reason, Articles 8 & 10 shall survive
such termination.

1.5 It is understood that the termination of this Agreement shall not prejudice the right of either
party to recover any sum due at the time of such termination, nor shall it prejudice any
cause of action or claim of either party which has accrued or which may accrue on account
of any breach, default or any violation under this Agreement by either party prior to such
termination.

2. SUPPLY OF SERVICES/GOODS

2.1 Subject to the terms and condition of this Agreement, Provider shall provide/deliver the
services/goods, this is further set forth on Schedule[A]“Statement of Work” attached
hereto.

2.2 In the event of Provider’s failure to (1) perform/deliver or (2) comply with the terms and
conditions under this Agreement, Company may secure Services/Goods from another
provider. If Company is compelled to source Services/Goods at a higher price due to
Provider’s failure to perform/deliver the Services/Goods for any reason, the additional costs
shall be paid by the Provider, together with compensation for damages suffered by
Company on account of Provider’s breach.

3. PAYMENTS AND INSURANCE

3.1 Payment terms and methods shall be included and is further stated on Schedule [B]
“Payment Terms” as attached hereto, including the applicable terms and conditions hereof;

3.2 All payments to the Provider shall be subject to the Withholding Tax under the existing
Expanded Withholding Tax Regulations, which the Company shall withhold and remit to the
Bureau of Internal Revenue, furnishing the Provider with the Certificate of Creditable Tax
Withheld At Source for such payment.

3.3 The Provider shall submit to the Company its billing or Statement of Account, including any
and all documents and reports that the Company requires for validation, within sixty (60)
days from performance/delivery of the Services/Goods or sixty (60) days from the agreed
date of billing. The Provider agrees that if it fails to submit its billing or Statement of Account

Classified as Confidential. Please do not forward this to unintended users. Otherwise, request necessary permission.
 within the prescribed period, it has waived its rights or that it can no longer claim, collect,
sue or recover payments for the Services/Goods.

3.4 The Provider shall secure at its own expense the insurance policies required by Company
(to be obtained from Company’s accredited insurance companies), to cover for losses,
damages, or liabilities that may arise in the performance or non-performance of Services or
for any liability or claims that may arise by reason of this Contract. The covering insurance
policies shall be kept by Company.

3.5 In the event that it becomes necessary to call on or file a claim on the above- mentioned
insurance or bond and should the loss, liability, claim, injury or damages be rejected by the
insurance for any reason, fall within the deductible or exceed the amount of the insurance
and bond policies, Provider shall be liable to Company for the full amount or the difference
of the loss, claim, injury or damage, whichever is applicable.

4. COMPLIANCE WITH COMPANY’S POLICIES AND RULES

4.1 The Provider agrees and binds itself to comply with the Company’s policies and rules, such
as, but not limited to those stated in Schedule [C]“Company Policies and Rules”hereof.

5. NOTICES & COMMUNICATIONS

5.1 Any communication shall be sufficiently delivered if sent in a letter by first class or air mail
prepaid post addressed to:
Company : Coca-Cola Beverages Philippines, Inc.
______________________________
______________________________

Attention : ____________________
Provider : ______________________________
______________________________
______________________________

Attention : ____________________

5.2 A notice shall be treated as effected at the time at which the letter containing it would be
delivered in the ordinary course of post.

6. USE OF TRADENAME OR TRADEMARK

6.1 COMPANY NAME. Without the Company's prior written approval, Provider shall not publish
or use any advertising, sales promotion, or publicity matter relating to the services,
equipment, materials, product or any other registered item furnished by the Company
pursuant to this agreement wherein the name of the Company and The Coca-Cola
Company and its products, trade names, trademarks, subsidiaries, and/or affiliates are
mentioned or their identity is implied.

Classified as Confidential. Please do not forward this to unintended users. Otherwise, request necessary permission.
 7. WORK PRODUCT AND INTELLECTUAL PROPERTY

7.1 As applicable, Provider hereby assigns on an exclusive basis all of Provider's right, title and
interest in and to the Product to Company, including any and all Intellectual Property Rights
therein. Accordingly, Provider agrees that it shall (i) not use any Product for the benefit of
any party other than Company, and (ii) perform such other acts (including, but not limited to,
cooperating with and assisting Company in the protection and enforcement of Company’s
rights in the Work Product, by adjudication or otherwise), and (iii) execute such other
documents and instruments as Company may now or hereafter deem reasonably necessary
or desirable to evidence the transfer of sole ownership of all Product to Company. If, by
operation of law, Provider is deemed to retain any rights in and to any Intellectual Property
Rights relating to the Product, Provider, to the extent that any such rights cannot be
assigned (including, without limitation, any and all moral rights therein), hereby waives all
such rights in perpetuity and exclusively in favor of Company, Company’s successors and
assigns.

7.2 Subject to Provider’s obligations relating to Company’s Confidential Information, Provider

shall be free to use its general skills, know-how and expertise in the course of providing its
services to others, provided that Provider shall not provide or disclose Confidential
Information (including Product) to any third party in so doing.

8. CONFIDENTIAL INFORMATION

8.1 Any information that may be received by or may come to the attention or knowledge of the
Provider or its subsidiaries and affiliates, and their respective employees or representatives
with regard to the Company, its parent company, affiliates, subsidiaries, customers, relative
to its products, trade and business operations obtained in or during the performance of
Provider’s obligations hereunder shall be treated with utmost confidence and shall not be
discussed or disclosed to any other person or entity or published and/ or disseminated
through any medium. Violation of this provision shall render Provider liable to Company for
any loss or damage that may be suffered by the Company by reason of such violation.

8.2 The Provider shall safeguard all material, whether written or otherwise, which the Company
supplies to it and shall not copy or duplicate such materials without the Company’s prior
written consent.

8.3 In the event of a breach or threatened breach of the foregoing provisions, damages to be
suffered by the Company will not be fully compensated in money damages alone, and
accordingly, the Company or the third-party owner of the confidential information shall, in
addition to other available legal or equitable remedies, be entitled to an injunction against
such breach or threatened breach.

9. NO EMPLOYER-EMPLOYEE RELATIONSHIP

9.1 There shall be no employer-employee relationship between the Company and the Provider’s

managers, employees, representatives and agents whom the Company may engage directly
or indirectly in connection with this Agreement. 

9.2 Provider is an independent contractor and not an agent, representative, or joint venture
partner of Company. It or any of its employees, personnel, or officers shall not enter into

Classified as Confidential. Please do not forward this to unintended users. Otherwise, request necessary permission.
 any contract or commitment on behalf of the Company and will be solely responsible for
making all payments to and on behalf of its employees and approved subcontractors
including those required by law. Company will not be liable for any debts or other liabilities
of Provider.

9.3 Provider shall hold the Company free and harmless from any and all claims of, or liabilities
to, Provider’s employees, agents, or representatives for salaries and wages, employees’
benefits, compensation for death, injury, or sickness, or for any other claim arising from or in
connection with their employment by Provider, including claims against Company for
regularization of employment. TheProvider assumes all liability for such claims and shall
indemnify Company for all expenses it may incur in defending itself therefrom.

9.4 Provider hereby authorized Company to offset the claims of its employees, the expenses
incurred in defending itself, and the charges and liabilities by reason of the Provider’s
negligence or breach of this Agreement, against any of its receivables from Company.

10. NO POACHING AND NON-SOLICITATION

10.1 During the term of this Agreement and for a period of one (1) year after the expiration or
termination of the same for whatever reason, Provider  agrees that it shall not induce or
attempt to induce any employee of the Company to leave the latter’s employ, or hire any
such employee in any capacity whatsoever.

11. WARRANTIES, INDEMNITY AND LIMITATIONS OF LIABILITY

11.1 Provider represents and warrants to Company that:

(a) Provider is duly organized, validly existing and in good standing under the laws of
the Philippines where it operates or has clients.
(b) Provider has all the requisite power and authority to enter into this Agreement and
to perform its obligations hereunder. All acts and other proceedings required to be
taken by it to authorize the execution and performance of this Agreement have
been duly and properly taken.
(c) Provider has the power, authority, permits, licenses and government
authorizations necessary to perform its obligations in this Agreement and to carry
on its business as now conducted.
(d) Provider shall comply with applicable laws, rules and regulations relating to the
Services/Goods contemplated in this Agreement.
(e) There is no conflict of interest that exists or likely to exist to arise in the
performance of its obligations under this Agreement.
(f) The performance of its obligations in this Agreement shall not infringe any
confidential information, copyright, patent, trade secret or other proprietary or IP
Right(s) of any third party or parties;

11.2 Unless due solely to the fault and/or gross negligence of the Company, Agreement shall
defend, indemnify and hold harmless the Company (including its parent, subsidiaries,
affiliates, officers, directors and associates, all of which are, for purposes of this provision,
included in the term “Company”) from and against all claims, losses, liability, including

Classified as Confidential. Please do not forward this to unintended users. Otherwise, request necessary permission.
 attorneys' fees and court costs incurred if any, suffered by or made against Company as a
result of Provider’s performance or non-performance of its obligations under and in
connection with this Agreement and/or Provider’s’ breach of the representations or
warranties herein, or by reason of any act, omission, neglect and breach of any terms and
conditions of this Agreement by the Provider or any of its managers, employees, service
providers, representatives or agents. This indemnity shall not limit any other obligation of
Provider to indemnify Company.

10. FORCE MAJEURE

10.1 It is hereby understood that if the performance required of either party under this Agreement
is delayed or prevented by an event of Force Majeure as defined below, it is the obligation of
the affected party to notify the other party in writing of such event within twenty-four (24)
hours after its occurrence.

11.3 If an event of Force Majeure occurs, a party’s contractual obligations under this Agreement
affected by such an event shall be suspended during the period of delay caused by Force
Majeure. Such party shall not be liable for failure to perform any part of this Agreement
when such failure is due to an event of Force Majeure. “Force Majeure” shall mean all
events which are beyond the control of the affected party and which are unforeseen,
unavoidable or insurmountable, and which arise after this Agreement has become effective
and which prevent total or partial performance by such party of its obligations under this
Agreement. Such events shall include earthquakes, typhoons, flood, fire, war, failure of
international or domestic transportation, acts of governments or public agencies, epidemics,
civil disturbances, or any other similar event beyond the reasonable control of the party
affected.

11.4 The happening of the events of Force Majeure shall not relieve either party from making
payments for existing obligations prior to the happening of the event of Force Majeure.

12. LAWS & JURISDICTION

12.1 This Agreement shall be governed by and construed in accordance with the laws of
Philippines for purposes of any action commenced under this Agreement or with respect to
any tort committed or alleged to be committed in the performance of this Agreement. No
choice of law rules of any jurisdiction shall apply hereto.

12.2 Any claim, dispute or controversy arising out of or in connection with or relating to this
Agreement or the breach or alleged breach hereof, shall be submitted to arbitration by the
Arbitration and Mediation body of the Country under the commercial rules then in effect for
such Association, except as may be otherwise expressly provided herein. All proceedings
shall be held and a transcribed record prepared in English. Each party shall choose one
arbitrator within thirty (30) days of receipt of notice of the intent to arbitrate. Within Fifteen
(15) days of receipt of the notice of the intent to arbitrate the two (2) arbitrators shall choose
a neutral third party arbitrator who shall act as chairman. If no arbitrator is appointed within
the times herein provided or any extension of time that is mutually agreed upon, the
Association shall make such appointment within fifteen (15) days of such failure. The award
rendered by the arbitrators shall include costs of arbitration, reasonable attorneys' fees and
reasonable costs for expert and other witnesses, and judgment on such award may be

Classified as Confidential. Please do not forward this to unintended users. Otherwise, request necessary permission.
 entered in any court having jurisdiction hereunder; provided however, that nothing in this
Section shall be deemed as preventing either party from seeking relief from the courts as
necessary to protect either party's name, proprietary information, trade secrets, know how or
any other appropriate provisional or equitable remedy.

13. GENERAL

13.1 Provider may not assign any rights or delegate any duties under this Agreement (other than
to receive payments) without the Company’s prior written consent (not to be unreasonably
withheld, conditioned, or delayed), and any attempt to do so without consent will be void.
The Company may assign this Agreement upon notice to Provider.

13.2 Unless the right of enforcement is expressly granted, it is not intended that a third party
should have the right to enforce a provision of this Agreement.

13.3 This Agreement, together with the Schedules, constitutes the entire agreement between the
parties and supersedes all communications, negotiations, arrangements and agreements,
whether oral or written, between the parties with respect to the subject matter of this
Agreement.

13.4 Each of the provisions of this Agreement is distinct and severable from the others and if at
any time one or more of such provisions is or becomes invalid, unlawful or unenforceable
(whether wholly or to any extent), the validity, lawfulness and enforceability of the remaining
provisions (or the same provision to any other extent) of this Agreement shall not in any way
be affected or impaired.

13.5 Nothing in this Agreement shall be deemed to constitute a partnership or agency

relationship between the parties or any other person. Save as expressly provided in this
Agreement, the execution, completion and implementation of this Agreement shall not
confer on either party or any other person any power to bind or impose any obligations on
the other party

13.6 The Parties may rescind or vary this Agreement in writing and with the consent of both
parties

13.7 This Agreement may be executed in counterparts, each of which when executed and
delivered shall be an original, but all the counterparts shall together constitute one and the
same instrument.

13.8 If any provision of this Contract is held unenforceable, then such provision will be modified
to reflect the parties' intention. All remaining provisions of this Agreement shall remain in full
force and effect.

AS WITNESS OF which this Agreement has been duly signed on the date written at the beginning of
this Agreement.

Classified as Confidential. Please do not forward this to unintended users. Otherwise, request necessary permission.
 EXECUTION PAGE

Executed by Company Executed by Provider

1st Signatory:................................................. 1st Signatory:.................................................

Position: Position:
Date: Date:

2nd Signatory: ………………………………….. 2nd Signatory: …………………………………..

Position: Position:
Date: Date:

Witness: ………………………………………… Witness: …………………………………………

Date: Date:

NOTARIAL PORTION (if required)

Classified as Confidential. Please do not forward this to unintended users. Otherwise, request necessary permission.
 Schedule[A]
STATEMENT OF WORK

Additional Statement of Work Description Attached? Yes No

Engagemen Coverage based on Letter of Intent dated January 30, 2019

t Period START:January 30, 2019
END:September 30, 2020
Detailed
Description 1. Quantity:116,250 MT or 2,325,000 50-kg bags
of Supply,
including Number of
Contract Description
Deliverable bags
s Minimum Volume 1,500,000
5% additional volume 75,000
Exercised Option
(up to 1M bags) 750,000
Total 2,325,000

2. Mill Mark/s:Any refined sugar millmarkacceptable to Coca-Cola Beverages

Philippines, Inc.

3. Quality:

60% Bottler’s Grade Premium Refined Sugar

- Not more than 35 ICUMSA with other Coca-Cola specification as per submitted
COA pursuant to BP-SP-116.

40% Enhanced Standard Refined Sugar

- Not more than 70 ICUMSA with other Coca-Cola specification as per submitted
COA pursuant to BP-SP-116.

4. Delivery: Pick-up, Ex-mill/warehouse

5. Duration of Pick-up:February 2020 to September 2020

6. Storage Charges:

Dura tio n Mo nthly Ra te / b a g (PHP, VAT EX)

First 30 d a ys a fte r DO d a te FREE
31-90 d a ys 1.00
91-150 d a ys 5.00
151 d a ys o n w a rd s 6.00

7. Rejection due to Quality Issue: Any quality issue, if found, supplier agrees any of the
following:
a) To take the sugar back with no cost to CCBPI and issue a credit note;
b) To replace the sugar with acceptable quality, at seller’s option.

Classified as Confidential. Please do not forward this to unintended users. Otherwise, request necessary permission.
 Engagemen
t Price: PHP 1,870/Lkg bag VAT Exclusive; Price is fixed for the duration of the contract.
Pricing/Cos
t

The undersigned hereby acknowledge that they have read and agree to be bound by the terms
and conditions of the Master Agreement, including the Term Sheet, additional Standard Terms
and Conditions if any, Statement of Work and any and all other agreements attached hereto or
subsequently executed (collectively, the “Agreement”):

COMPANY PROVIDER

____________________________________ ____________________________________
Signature Signature

____________________________________ ____________________________________
Print Name Print Name

____________________________________ ___________________________________
Title Title

____________________________________ ____________________________________
Date Date

Classified as Confidential. Please do not forward this to unintended users. Otherwise, request necessary permission.
 Schedule[B]
PAYMENT TERMS

Terms of Payment Thirty (30) calendar days after electronic submission of Sales Invoice
and Delivery Order (DO) via Supplier Self-Service Portal. Original
copy of Sales Invoice should be submitted directly to Accounts
Payable Shared Services (APSS).

Insurance Provider shall obtain and maintain in force adequate insurance

while sugar is inside their premises or external warehouses.
Provider, upon request, shall furnish certification evidencing such
insurance in a form acceptable to the Company.

Classified as Confidential. Please do not forward this to unintended users. Otherwise, request necessary permission.
 Schedule[C]
COMPANY POLICIES AND RULES

Provider undertakes to comply with applicable policies and rules of the Company to wit:

A. SUPPLIER GUIDING PRINCIPLES

Supplier is required to and hereby warrants that it will meet the following minimum standards with
respect to its operations as a whole:

Laws and Regulations. It will comply with all applicable laws, rules, regulations and
requirements in providing services to Company.
Child Labor. It will not use child labor, as defined by local law.
Forced Labor. It will not use forced or compulsory labor.
Abuse of Labor. It will not physically abuse labor.
Collective Bargaining. It will respect employees’ rights to choose whether to be represented
by third parties and to bargain collectively in accordance with local law.
Discrimination. Supplier will comply with all applicable local and national discrimination laws.
Wages and Benefits. Wages and benefits will comply with local law.
Working Hours & Overtime. Working hours and overtime will comply with local law
Health and Safety. Working conditions will comply with local regulations.
Environment. It will comply with all applicable environmental laws.

Other requirements may however be imposed by Company elsewhere in this Agreement or in

separate communications.

Provider agrees that it must be able to demonstrate its compliance with these requirements at the
request of and to the satisfaction of Company. This Agreement includes, but is not limited to, The
Coca-Cola Company, Company and its subsidiaries having the right to inspect any site involved in
work for Company and its subsidiaries. Should Provider fail to satisfy Company of its compliance, it is
subject to immediate termination of any agreements between it and Company and its subsidiaries
without penalty to Company and its subsidiaries but with obligations to remedy direct damages
suffered by Company and its subsidiaries. All other policies and guidelines of Company and its
subsidiaries and any other agreements to which Provider is a party shall continue in full force and
effect.

B. CODE OF BUSINESS CONDUCT

Provider agrees to supply each of its employees and subcontractors performing services with a copy
of the then-current Code of Business Conduct for Suppliers to The Coca-Cola Company, a copy of
which will be provided by Company to Supplier upon Supplier’s request, and set forth at
www.thecoca-colacompany.com. Provider will ensure compliance with the Code of Business Conduct
for Suppliers to The Coca-Cola Company by all of Supplier’s employees and subcontractors.

C. FOREIGN CORRUPT PRACTICES ACT (FCPA) AND U.K. BRIBERY ACT (UKBA)

Each Party represents and warrants to the other that it and its representatives, affiliates or
subsidiaries have complied with all laws dealing with corrupt or illegal payments, gifts, or gratuities,
including Republic Act No. 3019, the Anti-Graft and Corrupt Practices Act. Each Party agrees not to
(and to cause its representatives, affiliates or subsidiaries not to) in connection with the activities
contemplated by this Agreement pay, promise to pay, seek, accept, or authorize the payment of any
money or anything of value, directly or indirectly, to any person or entity (whether a governmental

Classified as Confidential. Please do not forward this to unintended users. Otherwise, request necessary permission.
 official or private individual) for the purpose of illegally or corruptly influencing any governmental
employee or official, any political party or official thereof or any candidate for political office.
Furthermore, each Party agrees that in connection with this Agreement and the activities
contemplated hereby, it and its representatives, affiliates or subsidiaries will not take any action, or fail
to take any action, which act or failure to act would subject the other Party or any of its
representatives, affiliates or subsidiaries to liability under the laws of its country of domicile dealing
with corrupt payments. Each Party agrees to indemnify the other Party from and against any loss,
liability or damage (including reasonable attorney’s fees) arising from or relating to such Party’s
breach of its representations, warranties, and obligations under this Clause. Each Party represents
and warrants to the other that prior to the date of this Agreement, it and its representatives, affiliates
or subsidiaries have not taken any action in contravention of the foregoing in connection with the
subject matter hereof.

This agreement is contingent upon compliance with all applicable laws, particularly the U.S. Foreign
Corrupt Practices Act and the U.K. Bribery Act as well as the laws of the Philippines in which services
are to be performed by Supplier on behalf of Company. As such, Supplier agrees that it will not, in
connection with transactions contemplated in this agreement, or in connection with any other business
transactions involving Company, transfer anything of value, directly or indirectly, to any government
official, employee of a government-controlled company, political party, or other private (non-
government) persons or entities working on behalf of any government in order to obtain any improper
benefit or advantage. The undersigned further warrants that no money paid to Provider as
compensation or otherwise has been or will be used to pay any bribe, facilitating payment or kickback
in violation of applicable laws. Provider agrees to provide prompt certification of its continuing
compliance with applicable laws whenever requested by Company.

Provider hereby represents and warrants that Provider and its agents and employees will not take any
action that might constitute a violation or breach of any provision of The Coca-Cola Company Supplier
Code of Business Conduct. By Provider’s signature to this Agreement, Supplier confirms that it has
read and understood The Coca-Cola Company Supplier Code of Business Conduct and consents to
be bound by its terms.

All agents or employees of Provider who will be involved in representing Company must be identified
in writing to Company and approved before they perform any actions on behalf of Company. The
Provider warrants that none of the agents or employees of Provider are government officials or
immediate family members of government officials. Provider further warrants that no payments will be
made by Provider on behalf of Company without obtaining prior approval from Company, unless
expressly provided in this Agreement as part of the services provided by Provider.

A written accounting must be kept of all payments made by Provider or its agents or employees on
behalf of Company, or out of funds provided by Company. A copy of this accounting must be
provided to Company upon request. At no time shall any payment be made by Provider or its agents
or employees to any undisclosed third party. Company reserves the right to audit Provider’s books
and records in order to satisfy itself that Provider is in compliance with the terms of this agreement.

Provider understands and agrees that no gift, meal, entertainment or anything of value shall be given
to any government official or entity in exchange for any business, benefit or advantage and without
the prior written consent of the Company’s legal department.

In the event that Company has reason to believe that any improper payments have been made by
Provider in violation of this Agreement, Company shall have the rights to further investigate in order to
satisfy itself that no breach has occurred. This includes, but is not limited to, the right to audit Provider

Classified as Confidential. Please do not forward this to unintended users. Otherwise, request necessary permission.
 's books and records relevant to the potential breach, as noted above. Upon receipt of a verbal or
written notification of investigation from Company, Provider shall cooperate fully, including the timely
provision of documents and willingness to make personnel available for witness interviews. Company
reserves the right to share its investigative findings with relevant enforcement authorities.

D. TRADE COMPLIANCE

Provider understands and acknowledges that Company is required to follow applicable trade
sanctions laws and regulations in all jurisdictions where it conducts business, including the general
prohibition on engaging with (a) the government of, or any entity, group or individual within, any
country that is the target of any laws administered by the Office of Foreign Assets Control,
Department of the Treasury (“OFAC”) or any other governmental entity around the world imposing
economic sanctions and trade embargoes (“Economic Sanctions Laws”), or (b) any government,
entity, group or individual who is named on the List of Specially Designated Nationals and Blocked
Persons or other similar lists maintained by any governmental entity pursuant to any Economic
Sanctions Laws (“Designated Person”).

Throughout the Term of the Agreement, Provider represents and warrants that it is not:

A Designated Person, blocked person and/or denied party; nor any of its subsidiaries or, to its
knowledge, any director, officer, or employee of Provider, is a Designated Person.

Owned or controlled by, or acting for or on behalf of, directly or indirectly, a Designated Person or any
person who is located, organized, or resident in a country or territory that is, or whose government is,
the target of Economic Sanctions Laws.

Directly or indirectly owned or controlled by the government of any country, or an agency or

instrumentality of the government of any country, that is itself subject to an embargo or sanctions
administered by OFAC, U.S. Department of Commerce’s Bureau of Industry of Security (“BIS”), and
other similar regulatory agencies around the world (“Embargoed Country”);

Acting on behalf of a government (or its agencies or instrumentalities) of any Embargoed Country;
and

Subject to any investigation by OFAC or any other governmental entity imposing economic sanctions
and trade embargoes (“Sanctions Investigation(s)”), or is directly or indirectly owned or controlled by
any person who is currently the subject of a Sanctions Investigation.

Provider also undertakes and agrees not to engage in any business, deal with, or in any way be
associated with Designated Persons and/or Embargoed Countries (including, Cuba, North Korea,
Iran, Syria and the Crimean region) for or on behalf of the Company, nor will Supplier directly or
indirectly source any products or ingredients or services used in the supply of products or ingredients
to Company from Designated Persons and/or Embargoed Countries.

Provider agrees that it will immediately provide written notice to Company upon the occurrence of any
event that would result in a breach of the foregoing. Notwithstanding anything to the contrary in the
existing Agreement between Company and Supplier, no transfer (including the sale, lease,
assignment or transfer in any way of any direct or indirect interest in the Agreement or direct or
indirect interest in Provider) shall be made to Designated Persons, to an entity in which an Designated
Person, blocked person and/or denied party has an interest, or to an Embargoed Country.

Classified as Confidential. Please do not forward this to unintended users. Otherwise, request necessary permission.
 Provider shall screen its employees and its suppliers, whom Provider engages, or considers
engaging, to perform production activities or services under the Agreement, in order to determine
whether any of Provider’s employees or suppliers are identified as a Designated Person.

Provider shall not engage any Designated Person to perform production activities or services under
the Agreement. Provider shall notify Company immediately, in writing, of any of Provider’s employees
or suppliers who have been listed as a Designated Person and have performed production activities
or services under the Agreement. Provider shall incorporate this provision in all subcontracts with its
suppliers or independent contractors with whom Provider engages or employs, or intends to engage
or employ, to perform production activities or services under the Agreement.

E. RIGHT TO AUDIT

Company and its authorized representative may from time to time, upon reasonable notice, audit
Supplier for the sole purpose of determining Supplier's compliance with its obligations under this
Agreement. Supplier shall make available such of its personnel, records and facilities as are
reasonably requested by Company for the conduct of such audit.

F. DATA PRIVACY REQUIREMENTS

Supplier is required to and hereby warrants that it will comply with the Data Privacy Requirements of
Company specifically:

1. Data Privacy and Security. Agency must adhere to Company’s security and data privacy,
data classification and protection policies with respect to its Services and Deliverables, which are
available at https://partner.coca-cola.com/sites/AgencyOperations/SitePages/Home.aspx, as in effect
on the date of execution of the Agreement and as updated or revised from time to time and made
available to Agency. If, in rendering Services hereunder, Agency will be provided access to or
otherwise obtain from, or on behalf of, Company any Personal Information, Agency will comply with
the following provisions. The parties agree that if such provisions do not comply with all laws
applicable to the Services subject to this provision, such provisions can be altered in writing as
provided by this Agreement.

1.1 Definitions. For the purposes of this Agreement, the following definitions shall apply:
(i) “Personal Information” means any information that identifies or relates to an identifiable
individualincluding, without limitation –
(a) name;
(b) mailing address;
(c) telephone or fax number;
(d) email address; and
(e) government identification number.
(ii) “Security Incident” means any accidental or unauthorized access, acquisition, use,
modification, disclosure, loss, destruction of or damage to Personal Information, or any other
unauthorized Processing of Personal Information under the control of Agency, by any current
or former employee, contractor or agent of Agency or by any other person or third party.
(iii) “Adequacy Decision” means a decision issued by the European Commission under 45
Regulation (EU) 2016/67.
(iv) “Process” or “Processing” means the collection, recording, organization, structuring,
alteration, use, access, disclosure, copying, transfer, storage, deletion, combination,
restriction, adaptation, retrieval, consultation, destruction, disposal, or other use of Personal
Information.
(v) “Special Categories of Data” mean any of the following types of Personal Information: (i)
social security number, taxpayer identification number, passport number, driver’s license
number or other government-issued identification number; (ii) credit or debit card details or
financial account number, with or without any code or password that would permit access to
the account or credit history; or (iii) information on race, religion, ethnicity, sex life or practices
or sexual orientation, medical or health information, genetic or biometric information, biometric
templates, political or philosophical beliefs, political party or trade union membership,

Classified as Confidential. Please do not forward this to unintended users. Otherwise, request necessary permission.
 background check information or judicial data such as criminal records or information on other
judicial or administrative proceedings.

1.2 Limitation on Use. Agency will only Process Personal Information on behalf of Company to
deliver Services in accordance with the Agreement (including this Agreement and the exhibits and
attachments hereto and other documents incorporated by reference) and the applicable Project
Statement(s) or other documented instructions of Company, whether in written or electronic form
(collectively, the “Instructions”). The scope, classification, purposes and details of Processing are
described in the applicable Project Statement(s). Agency is prohibited from Processing Personal
Information in deviation from the Instructions unless Company agrees to such deviation in writing.

1.3 Technical and Organizational Measures. Agency shall implement technical and
organizational measures for the Processing of Personal Information under this Agreement
(“Information Security Program”) containing, at a minimum, the requirements set forth in this Section
1.3. The measures shall be subject to technical progress and further development. For this purpose,
Agency shall be permitted to implement alternative adequate measures so long as the security level is
not reduced below that furnished by the measures required under this Section 1.3. Material changes
must be documented. Agency must, on request, make the documented security measures available to
Company.
(i) Information Security Policies and Standards. Agency will implement security
requirements for staff and all subcontractors, suppliers, or agents who have access to
Personal Information that are designed to:
(a) Prevent unauthorized persons from gaining access to Personal Information
Processing systems (physical access control);
(b) Prevent Personal Information Processing systems being used without
authorization (logical access control);
(c) Ensure that persons entitled to use a Personal Information Processing system
gain access only to such Personal Information as they are entitled to access in
accordance with their access rights and that, in the course of Processing or use and
after storage Personal Information cannot be read, copied, modified or deleted
without authorization (data access control);
(d) Ensure that Personal Information processed using Agency’s (and its
subcontractors’) Personal Information Processing systems cannot be read, copied,
modified or deleted without authorization during electronic transmission, transport or
storage, and that the target entities for any transfer of Personal Information by means
of data transmission facilities can be established and verified (data transfer control);
(e) Ensure the establishment of an audit trail to document whether and by whom
Personal Information have been entered into, modified in, transferred or removed
from Personal Information Processing (entry control);
(f) Ensure that Personal Information are Processed solely in accordance with the
Instructions (control of instructions);
(g) Ensure that Personal Information are protected against accidental destruction or
loss (availability control); and
(h) Ensure that Personal Information collected for different purposes can be
Processed separately (separation control).

Agency will conduct periodic risk assessments and review and, as appropriate, revise
its information security practices at least annually or whenever there is a material
change in Agency’s business practices that may reasonably affect the security,
confidentiality or integrity of Personal Information, provided that Agency will not
modify its information security practices in a manner that will weaken or compromise
the confidentiality, availability or integrity of Personal Information.

(ii) Physical Security. Agency will maintain commercially reasonable security systems at all
Agency sites at which an information system that uses or houses Personal Information is
located. Agency will reasonably restrict access to such Personal Information appropriately.

(iii) Organizational Security. When media are to be disposed of or reused, Agency will
implement procedures to prevent any subsequent retrieval of any Personal Information stored
on them before they are withdrawn from the inventory. When media are to leave the

Classified as Confidential. Please do not forward this to unintended users. Otherwise, request necessary permission.
 premises at which the files are located as a result of maintenance operations, Agency will
implement procedures to prevent undue retrieval of Personal Information stored on them.

Agency will implement security policies and procedures to classify Special Categories of Data
assets, clarify security responsibilities and promote awareness for employees.

Agency will manage all Personal Information Security Incidents in accordance with
appropriate incident response procedures.

Agency will encrypt, using industry-standard encryption tools, all Special Categories of Data
that Agency: (i) transmits or sends wirelessly or across public networks; (ii) stores on laptops
or portable storage media; and (iii) stores on portable devices, where technically feasible.
Agency will safeguard the security and confidentiality of all encryption keys associated with
encrypted Special Categories of Data.

(iv) Network Security. Agency will maintain network security using commercially
available equipment and industry-standard techniques, including firewalls, intrusion detection
and prevention systems, access control lists and routing protocols.

(v) Access Control.

(a) Agency will maintain appropriate access controls, including, but not limited to,
restricting access to Personal Information to the minimum number of Agency
employees, contractors, subcontractors or agents who require such access.
(b) Agency will ensure that only authorized staff can grant, modify or revoke access to
an information system that uses or houses Personal Information. Agency will
maintain proper access records, which must be presented to Company upon
Company’s request.
(c) Agency will implement user administration procedures that define user roles and
their privileges and how access is granted, changed and terminated. Agency will
address appropriate segregation of duties and define the logging/monitoring
requirements and mechanisms.
(d) Agency will ensure that all employees of Agency are assigned unique User-IDs.
(e) Agency will ensure that access rights are implemented adhering to the “least
privilege” approach.
(f) Agency will implement commercially reasonable physical and electronic security to
create and protect passwords.

(vi) Virus and Malware Controls. Agency will install and maintain the latest anti-virus and
malware protection software on the system and have in place scheduled malware monitoring
and system scanning to protect Personal Information from anticipated threats or hazards and
protect against unauthorized access to or use of Personal Information.

(vii) Personnel.

(a) Prior to providing access to Personal Information to Agency employees,

contractors, subcontractors or agents, Agency will require such persons to comply
with its Information Security Program.
(b) Agency will implement a security awareness program to train personnel about
their security obligations. This program includes training about data classification
obligations; physical security controls; security practices; and Security Incident
reporting.
(c) Agency will have clearly defined roles and responsibilities for the employees.
(d) Agency will require employees to strictly follow established security policies and
procedures. Agency applies disciplinary processes if employees commit a security
breach.

(viii) Business Continuity. Agency will implement appropriate back-up and disaster recovery
and business resumption plans. Agency will review both business continuity plans and risk
assessments regularly. Agency will test and update regularly business continuity plans to
ensure that they are up to date and effective.

Classified as Confidential. Please do not forward this to unintended users. Otherwise, request necessary permission.
 (ix) Primary Security Manager. Agency will notify Company of its designated primary
security manager. The security manager will be responsible for managing and coordinating
the performance of Agency’ obligations set forth in its Information Security Program and in
this Agreement.

1.4 Security Incidents. Agency shall notify Company in writing immediately (and in any event
within 24 hours) whenever Agency reasonably believes that there has been a Security Incident. After
providing notice, Agency will investigate the Security Incident, take all necessary steps to eliminate or
contain the exposure of Personal Information, and keep Company advised of the status of the
Security Incident and all related matters. Agency further agrees to provide, at Agency’ sole cost,
reasonable assistance and cooperation requested by Company and/or Company’s designated
representatives, in the furtherance of any correction, remediation, or investigation of any Security
Incident and/or the mitigation of any damage, including any notification that Company may determine
appropriate to send to affected individuals, regulators or third parties, and/or the provision of any
credit reporting service that Company deems appropriate to provide to affected individuals. Unless
required by law, Agency shall not notify any individual or any third party other than law enforcement of
any potential Security Incident involving Personal Information without first consulting with, and
obtaining the written permission of, Company. In addition, within 30 days of identifying or being
informed of a Security Incident, Agency shall develop and execute a plan, subject to Company’s
approval, that reduces the likelihood of a recurrence of a Security Incident.

1.5 Information Return or Disposal. Notwithstanding any contrary provision of the Agreement,
Agency shall comply with the following: Agency shall, as appropriate and as directed by Company,
regularly dispose of Personal Information that is maintained by Agency, but that is no longer
necessary to provide the Services. Upon termination or expiration of the Agreement for any reason or
upon Company’s request, Agency shall immediately cease handling Personal Information and shall,
within 30 days, return in a manner and format reasonably requested by Company, or, if specifically
directed by Company, destroy, any or all Personal Information in Agency’ possession, power or
control, except as otherwise required by law applicable to Agency. If Agency has such a legal
obligation to retain Personal Information beyond the period otherwise specified by this Agreement,
Agency will notify Company in writing of that obligation, to the extent permitted by applicable law, and
will return or destroy Personal Information in accordance with this Agreement as soon as possible
after that legally required retention period has ended. If Agency disposes of any paper, electronic or
other record containing Personal Information, Agency shall do so by taking all reasonable steps
(based on the sensitivity of the information) to destroy the Personal Information by: (a) shredding; (b)
permanently erasing and deleting; (c) degaussing; or (d) otherwise modifying the Personal Information
in such records to make it unreadable, unreconstructable and indecipherable. Upon request, Agency
will provide a written certification that Personal Information has been returned or securely destroyed in
accordance with this Agreement. This written certification will be issued by Agency. Company has
the right, at Company’s expense, to require that Agency provide the written certification from any third
party providing destruction services.

1.6 Subcontracting. Agency will ensure that Personal Information is not disclosed to, transferred
to or allowed to be accessed by any third party (including affiliates and subcontractors) without the
prior written permission of Company, except (i) as specifically stated in this Agreement, or (ii) where
such disclosure or transfer is required by any applicable law, regulation, or public authority. If
Company approves Agency’ disclosure of and/or transfer granting access to Personal Information to a
third party (“Authorized Subcontractor”), the Authorized Subcontractor will, prior to any disclosure,
transfer or access, have entered into an agreement at least as restrictive as this Agreement. The
agreement will be provided to Company promptly upon request. Agency will remain accountable and
responsible for all actions by such third parties with respect to the disclosed, transferred or accessed
Personal Information. If Company and Agency are located within the European Economic Area (EEA)
or Switzerland, and Agency transfers data to an Authorized Subcontractor outside the EEA or
Switzerland, Agency will enter into a Model Clauses Agreement (as defined below) with the
Authorized Subcontractor in Company’s name and on Company's behalf, unless: (i) the transfer is to
an Authorized Subcontractor in the United States pursuant to Privacy Shield or any successor
program; (ii) Authorized Subcontractor has implemented and is bound by Binding Corporate Rules for
Processors in all jurisdictions where Personal Information will be transferred and Processed; or (iii)
the transfer is to an Authorized Subcontractor located in a country covered by an Adequacy Decision

Classified as Confidential. Please do not forward this to unintended users. Otherwise, request necessary permission.
 by a competent authority with jurisdiction over Company affiliate. Upon Company’s request, Agency
will provide the executed Model Clauses Agreement to Company.

1.7 Data Integrity. If applicable, Agency will ensure that all Personal Information created by
Agency on behalf of Company is accurate and, where appropriate, kept up-to-date. Further, upon
learning that any Personal Information is inaccurate or incomplete, Agency will erase or rectify such
Personal Information in accordance with Company’s instructions or applicable provisions in this
Agreement.

1.8 Access Requests. Agency will promptly notify Company in writing (and in any event within 2
days of receipt), unless specifically prohibited by applicable law, if Agency receives: (i) any requests
from an individual with respect to Personal Information processed including, but not limited to, opt-out
requests, requests for access and/or rectification, erasure, restriction, requests for data portability,
and all similar requests or(ii) any complaint relating to the processing of Personal Information
including, but not limited to, allegations that the processing infringes an individual’s rights under
applicable law. Agency will not respond to any such request or complaint unless expressly authorized
to do so by Company or required to do so by applicable law, will cooperate with Company with
respect to any action taken relating to such request or complaint, and will seek to implement
appropriate processes (including technical and organizational measures) to assist Company in
responding to requests or complaints from individuals.

1.9 Production Requests. If Agency receives any order, demand, warrant, or any other document
requesting or purporting to compel the production of Personal Information under applicable law
(including, for example, by oral questions, interrogatories, requests for information or documents in
legal proceedings, subpoenas, civil investigative demands or other similar processes), Agency shall
immediately notify Company (except to the extent otherwise required by applicable law) and shall not
disclose the Personal Information to the third party without providing Company at least 48 hours,
following such notice, so that Company may, at its own expense, exercise such rights as it may have
under law to prevent or limit such disclosure. Notwithstanding the foregoing, Agency shall exercise
commercially reasonable efforts to prevent and limit any such disclosure and to otherwise preserve
the confidentiality of the Personal Information and shall cooperate with Company with respect to any
action taken with respect to such request, complaint, order or other document, including to obtain an
appropriate protective order or other reliable assurance that confidential treatment will be accorded to
the Personal Information. Agency’ compliance with any production request shall be at Company’s sole
expense, except where such request arises from or relates to Agency’ acts or omissions, in which
case such compliance shall be at Agency’ sole expense.

1.10 Investigations. Upon notice to Agency, Agency shall assist and support Company in the
event of an investigation by any regulator, including a data protection regulator, or similar authority, if
and to the extent that such investigation relates to Personal Information handled by Agency on behalf
of Company. Such assistance shall be at Company’s sole expense, except where such investigation
was required due to Agency’ acts or omissions, in which case such assistance shall be at Agency’
sole expense.

1.11 Transfer, Disclosure and Access. Agency will hold Personal Information in strict confidence
and impose confidentiality obligations on all employees, contractors, subcontractors or agents that
Agency authorizes to Process Personal Information, including to protect all Personal Information in
accordance with the requirements of this Agreement (including during the term of their employment or
engagement and thereafter)

1.12 Further Assurances. Agency will provide relevant information and assistance reasonably
requested by Company to demonstrate Agency’ compliance with its obligations under this Agreement
and privacy laws and assist Company in meeting its obligations, with respect to such party’s
Processing of Personal Information under this Agreement, under data protection laws regarding: (i)
registration and notification; (ii) accountability; (iii) ensuring the security of the Personal Information;
and (iv) the carrying out of privacy and data protection impact assessments and related consultations
of data protection authorities. Agency will inform Company promptly if Agency believes that any
instructions of Company regarding the Processing of Personal Information would violate applicable
law. Agency will also notify Company promptly if Agency: (i) has reason to believe that it is unable to
comply with any of its obligations under this Agreement or any applicable privacy laws and it cannot

Classified as Confidential. Please do not forward this to unintended users. Otherwise, request necessary permission.
 cure this inability to comply within a reasonable timeframe; or (ii) becomes aware of any
circumstances or change in applicable law that is likely to prevent it from fulfilling its obligations under
this Agreement. In the event that this Agreement, or any actions to be taken or contemplated to be
taken in performance of this Agreement, do not or would not satisfy either party’s obligations under
such laws, the parties shall negotiate in good faith upon an appropriate amendment to the Agreement.

1.13 Changes. The requirements by either Company or Agency relating to any changes of the
written processing instructions or the actions to implement such instructions shall require an
amendment to the applicable Project Statement. If such a change requirement is generated by a
modification in the privacy laws and is required for ongoing compliance with such privacy laws, then
Company will have the right to require the implementation of the requested change even if the parties
have not yet signed an amendment to the applicable Project Statement. In such event, Company
agrees to pay the reasonable fee charged by Agency in consideration for the implemented change.

1.14 Third-Party Beneficiaries. The parties agree that Company Affiliates are intended third-party
beneficiaries of the Agreement, including this Agreement, and that the Agreement is intended to inure
to the benefit of such affiliates. Without limiting the foregoing, Company Affiliates will be entitled to
enforce the Agreement as if each was a signatory to the Agreement. Company also may enforce the
provisions of this Agreement on behalf of Company Affiliates (instead of Company Affiliate(s)
separately bringing a cause of action against Agency).

1.15 Survival. Notwithstanding any contrary provision of the Agreement, the obligations of Agency
under this Section 1 shall continue for so long as Agency continues to have access to, is in
possession of or acquires Personal Information, even if all agreements between Agency and
Company have expired or been terminated.

2. Restricted Transfers from EEA and Switzerland or Similar Countries. For purposes of
this Section 2, “Transfer” means the access by, transfer or delivery to, or disclosure of Personal
Information to a person, entity or system located in a country or jurisdiction other than the country or
jurisdiction where the Personal Information originated from. This Section 2 applies solely when a
Company Affiliate located in a Member State of the EEA, and Switzerland (collectively, “EEA”)
Transfers Personal Information to Agency or an Authorized Subcontractor in a location that is: (i)
located outside the EEA and (ii) not covered by an Adequacy Decision.

2.1 BCR-P. When the Transfer to Agency is covered by Agency’ Binding Corporate Rules for
Processors, Agency represents, warrants, and covenants (i) that it will maintain and extend its EEA
authorization of its Binding Corporate Rules for Processors for the duration of the Agreement; (ii) that
it will promptly notify Company of any subsequent material changes in such authorization; and (iii) to
downstream any of its obligations under its Agency Binding Corporate Rules for Processors to
Authorized Subcontractors by entering into an appropriate onward transfer agreement with any such
Authorized Subcontractor.

2.2 Privacy Shield. To the extent Agency Binding Corporate Rules for Processors does not cover
the Transfer, and the Transfer is to Agency in the United States and such Transfer is covered by the
Privacy Shield certification of Agency, Agency represents, warrants, and covenants (i) that it has
certified to the United States Department of Commerce that it complies with the Privacy Shield
principles and supplemental principles located at https://www.privacyshield.gov/EU-US-Framework,
as may be amended from time to time, except that Agency will not be responsible for providing notice
and choice and responding to requests for access and enforcement other than as set out in this
Agreement (Privacy Shield Obligations); (ii) that it will maintain its certification to the Privacy Shield for
the duration of the Agreement; and (iii) to downstream any of its Privacy Shield Obligations to
Authorized Subcontractors by entering into an appropriate onward transfer agreement with any such
Authorized Subcontractor.

2.3 In all cases other than covered by 2.1 and 2.2, the relevant Transfer will be governed by the
Standard Contractual Clauses Controller to Processor. The form of the Company’s Standard
Contractual Clauses Agreement is available at https://partner.coca-
cola.com/sites/AgencyOperations/SitePages/Home.aspx (“Model Clauses Agreement”). The Model
Clauses Agreement shall be completed, signed and incorporated into this Agreement by reference.

Classified as Confidential. Please do not forward this to unintended users. Otherwise, request necessary permission.
 2.4 When Company or a Company Affiliate in a non-EEA country in which the competent data
protection authority has approved the use of the EU Standard Contractual Clauses Transfers
Personal Information to Agency or its Authorized Subcontractors located outside such non-EEA
country, such Transfer will be governed by the Model Clauses Agreement, which if applicable, shall
be completed, signed and incorporated into this Agreement by reference.

3. Audits. 

3.1 Annual Audit. Once every 12 months, subject to any contrary provisions of Section 4 of this
Agreement, Agency will provide to Company, its own personnel, or an independent third party chosen
by Company and reasonably acceptable to Agency, on reasonable notice: (i) access to Agency’
information, Processing premises, and records; (ii) reasonable assistance and cooperation of Agency’
relevant staff; and (iii) reasonable facilities at Agency’ premises for the purpose of Company’s audit, at
Company’s expense, of Agency’ compliance with its obligations under this Agreement. Company may
instead of conducting an on-site audit ask for and receive a copy of its most recent third party
assessment, such as an ISO 27001, SSAE 16 SOC 2, ISAE 3402 or similar assessment. Company
remains entitled to conduct an audit as described in this paragraph, even if such a certificate is
provided. In no event shall Agency permit Company’s personnel or any independent third party to
inspect Agency’ premises unescorted.  

3.2 Security Incident Audit. If Agency gives notice of a Security Incident as described in Section
1.4, then Company shall have the following audit rights, in addition to any other audit rights under the
Agreement or this Agreement. Subject to any contrary provisions of Section 4 of this Agreement,
Company will have the right to perform, at Company’s cost, by an independent third party chosen by
Company and reasonably acceptable to Agency, or through Company’s own personnel, a follow-up
audit to ensure all reasonably necessary corrective actions have been taken. In no event shall
Agency permit Company’s personnel or any independent third party to inspect Agency’s premises
unescorted. If such an audit concludes that Agency has not adequately taken corrective action to
correct the problems, then (i) Agency will promptly take whatever corrective actions are reasonably
necessary to correct the problems; and (ii) Agency will reimburse Company for all reasonable costs of
the audit.  The rights and remedies afforded Company under this paragraph will continue until all
reasonably necessary corrective actions have been taken.

4. Audit Confidentiality. The parties agree that if Agency policies do not permit Company’s
own personnel to perform any audit or security review required or permitted under this Agreement,
Company will conduct such audit or security review through a third-party auditor selected by Company
and reasonably acceptable to Agency, and Agency will reimburse Company’s cost of conducting any
such audit or security review. Company agrees that any third-party auditor or security firm will enter
into a written agreement with Agency and Company that requires such firm to (i) use any Agency
confidential information solely for purposes of the inspection or audit, (ii) keep Agency’ confidential
information (including any information relating to its other clients) confidential, and (iii) handle such
information in accordance with the same procedures that apply to Agency’ handling of Company
confidential information. The parties further agree that if Agency policies also prohibit Company’s
third-party auditors from performing any audit or security review required or permitted under this
Agreement, Agency will, upon Company’s request, engage Agency’ independent auditing firm, acting
with a duty to Agency, to conduct such audit or security review, at Agency’ expense, and such firm
will, at Agency’ expense, provide Company with a management representation letter certifying to
Company the results of such audit or review, including all findings, comments and recommendations
for further action.

Classified as Confidential. Please do not forward this to unintended users. Otherwise, request necessary permission.