The parties have entered into a data processing agreement for Ariadne in accordance with Art. 28 GDPR (hereinafter referred to as the "Main DPA").

The client intends to use the optional process management feature to support the setup and operation of the audit management, action management, and risk management modules, which requires an amendment to the Main DPA.

Details are provided below:

‍

1.1 The Main DPA and this supplementary agreement apply jointly to process management. This supplementary agreement exclusively governs the additions mentioned herein (in particular, the additional sub-processors according to Appendix 1). In the event of any conflict between the Main DPA and this supplementary agreement regarding process management, this supplementary agreement shall take precedence.

1.2 The term of this supplementary agreement is aligned with the term of the Main DPA and applies for the duration of the use of process management; furthermore, the post-termination and confidentiality obligations stipulated in the Main DPA shall apply accordingly.

‍

2.1 The processor provides services to the client within the scope of process management to support the mapping, maintenance, and use of process management-related information and workflows (e.g., structured information, documentation, evaluations, support functions).

2.2 The processor processes personal data for process management exclusively on behalf of and in accordance with the instructions of the client, as stipulated in the Main DPA.

‍

The type(s) of personal data and the categories of data subjects correspond to the categories described in Appendix 1 of the Main DPA.

‍

4.1 The provisions of the Main DPA, particularly those regarding the use of sub-processors, apply accordingly to the engagement of sub-processors, information regarding intended additions/replacements, and any right of objection.

4.2 In addition to the sub-processors named in Appendix 3 – Approved Sub-processors of the Main DPA, the sub-processors listed in Appendix 1 of this supplementary agreement are also engaged for process management.

4.3 To the extent that sub-processors are based outside the EU/EEA or access from a third country cannot be excluded, data transfers to third countries shall only take place in accordance with the requirements for third-country transfers stipulated in the Main DPA.

‍

The technical and organizational measures agreed upon in the main DPA (specifically Annex 2) also apply to process management.

‍

Otherwise, the provisions of the main DPA apply.

‍

The processor engages third parties to process data on behalf of the controller ("subcontractors"). In addition to the subcontractors named in Annex 3 of the main DPA, the following additional processors are engaged for process management, the appointment of which the controller hereby approves: