Data Protection Agreement

You, the Employer (“you”), have agreed to be bound by Edvo Inc.’s (“Edvo”) Employers’ Terms and Conditions (the “Terms”) and by agreeing to this data protection agreement (this “Agreement”), you also adopt and agree to be bound by the Privacy Policy entered into between Edvo and any potential Candidate (as such tern us defined below) (the Terms and the Privacy Policy shall be referred to herein together as the “Binding Commitments”). Capitalized terms used but not defined herein shall have the meaning ascribed to them under the Terms. Pursuant to the Terms, you have requested and agreed to receive from Edvo certain information and personal data of third-party candidates (herein: “Candidates” or “data subjects”). This Agreement sets out the rights and obligations that apply to you, and with which you agree to comply, relating to the Candidates’ personal data (as this term is defined and used in the applicable data protection laws) provided to you by Edvo within the framework and as part of the Services offered to you by Edvo, as further described under the Terms (the “Services”).

This Agreement and the Binding Commitments are interdependent, and cannot be terminated separately. However, each of the Agreement and the Binding Commitments may be amended or replaced, in whole or in part, without effecting the validity or enforceability of the other.

This Agreement shall take priority over any similar provisions contained in other agreements between you and Edvo, including those contained in the Binding Commitments. This Agreement does not exempt you from obligations to which you are subject pursuant to any applicable data protection law or other legislation.

The processing activity covered by this Agreement is for the sole purpose of identifying and hiring suitable Candidates for your vacant positions. This Agreement applies specifically and exclusively to the activities outlined herein and does not apply to any other data processing in which either party may engage.

YOUR RIGHTS AND OBLIGATIONS

You shall be responsible to Edvo, to the Candidates and to any authority, for ensuring that your processing and control of personal data is compliant with all applicable data protection laws. You shall therefore have both the right and obligation to make decisions about the purposes and means of the processing and control of personal data by you, on your behalf, and by your instruction. You shall also be responsible for ensuring that any processing of information Edvo is instructed to perform on your behalf is permitted by the laws of your jurisdiction.

CONFIDENTIALITY

You shall ensure that only those persons who are authorized, at any given time, are able to access the personal data being processed. You shall ensure that access to the data shall be denied without delay if such authorization is removed or expires. Only persons who require access to the personal data in order to fulfil the purpose of the Agreement shall be provided with such authorization to access.

You shall ensure that persons authorized to process personal data have undertaken to observe the confidentiality of such data or are subject to suitable obligation of confidentiality, and shall not use or otherwise exploit such personal data for any purpose other than for the purpose described under the Terms. You shall, at the request of the Edvo, demonstrate that such persons are subject to the above confidentiality and non-use limitations.

SECURITY OF PROCESSING

You commit to take all actions necessary, on a regular basis, to assess potential security risks in your processing of private and confidential information against accidental or unlawful alteration, unauthorized disclosure, access or use, and to immediately implement measures necessary to resolve any identified security risks.

The above obligation means that you shall perform a risk assessment and thereafter implement measures to counter the identified risk.

USE OF PROCESSORS

When you are using a third party processor to process any portion of the personal data subject to this Agreement, you shall ensure that such processor is subject to at least the same degree of data protection obligations as those specified in this Agreement, on the basis of a written contract or other legal document, specifically providing necessary guarantees to ensure that the processor will implement the appropriate technical and organizational measures required to protect such data, in such a way that the processing meets the requirements of the applicable data protection law. Implementing the measures set forth in this Agreement, and imposing the restrictions required hereby, shall not derogate from any additional obligation you may have under any applicable law.

A copy of such a processor agreement and subsequent amendments shall, at Edvo’s request, be submitted to Edvo. Commercial terms and conditions incorporated into such agreement and subsequent amendments, such as pricing, that do not affect the legal data protection content of the processor agreement, shall not require submission to Edvo.

You shall provide to all third-party data processors a fully executed and binding authorization, providing Edvo, in the event of bankruptcy or liquidation of your company or business, with the authority to instruct the third-party processor regarding the handling and erasure of all personal data provided to you by Edvo. A copy of said authorization shall be provided to Edvo. In any event and without derogating from any right or action Edvo may take against any data processor, you shall always remain fully liable to the Edvo with regards the fulfilment of the obligations of the processor.

ASSISTANCE

Taking into account the nature of the processing, each party shall, to the maximum extent possible, assist the other party with appropriate technical and organizational measures, in the fulfilment of the party’s obligations to respond to requests for the exercise of the data subjects’ rights.

PERSONAL DATA BREACH NOTIFICATION

Each party shall immediately notify the other party of any personal data breach (as this term is defined and used in the applicable data protection laws) upon the party’s discovery of any such breach regarding the personal data provided to you by Edvo. The parties shall use commercially reasonable efforts to mitigate any such breach and prevent its recurrence. You and Edvo will cooperate in good faith on issuing any statements or notices regarding such breaches, to the appropriate authorities and to the data subjects.

ERASURE AND RETURN OF DATA

Upon termination of the Services, you shall erase all existing copies of the personal data of all data subjects (including any Candidates Report), provided to you by Edvo, unless applicable law that cannot be conditioned requires storage of the personal data. Upon Edvo’s request you shall confirm to Edvo, in writing and signed by the appropriate person of authority, performance of the foregoing.

INSPECTION AND AUDIT

Edvo shall be authorized, upon request, to audit your data processing system and files to ensure compliance with the requirement set forth herein. You shall make available to the Edvo all information necessary to demonstrate compliance with data protection laws, this Agreement and the Privacy Policy, and allow for and contribute to audits, including inspections performed by Edvo or another auditor mandated by the Edvo.

INDEMNIFICATION

You (“Indemnifying Party”) will indemnify and hold Edvo, its subsidiaries, partners and their respective shareholders, directors, officers, employees, service providers and advisors (each, an “Indemnified Party”) harmless, from and against any claim and/or loss, damage or expense (including legal fees) suffered, sustained or incurred by any Indemnified Party, as a result or in connection with: (i) your use or the use of anyone acting on your behalf, of any information provided by Edvo to you, including, and without limitation, information of the Candidates, (ii) any breach of this Agreement and/or violation of any applicable law, or (iii) any data breach, theft, loss and/or corruption of personal data, including, but not limited to, claims received from, or allegations made by, Candidates, and any penalties imposed by any governmental and/or quasi-governmental authority in any territory (including, and without limitation, in the US or UK or EU), relating to any of the foregoing. This provision shall survive the termination of this Agreement, without limitation in time.

COMMENCEMENT AND TERMINATION

This Agreement shall become effective on the date you apply to the Services. This Agreement may be renegotiated or revised, upon the request of either party, if such renegotiation or revision becomes necessary due to revisions in applicable law or for any other reason mutually agreed upon by the parties.

This Agreement may be terminated in accordance with the Terms. The requirements and responsibilities contained herein relating to the processing and maintenance of the security of personal data of Candidates shall continue to apply as long as the processing of such data continues to be performed by you or on your behalf, irrespective of the termination of this Agreement.