Avanan GDPR Data Processing Amendment Agreement

Revision: 2018-08-02

6: SUBPROCESSING

6.3 Avanan may provide for a website or provide another notice that lists all subprocessors, which have access to personal data of its Customer as well as the limited or ancillary services they provide. At least 14 days before authorizing any new subprocessor gains access to personal data, Avanan will update its website, notify Customer and grant the opportunity to object to such change. Upon Customer’s request, Avanan will provide all information necessary to demonstrate that the subprocessor will meet all requirements pursuant to Sect. 6.1 and 6.3. In the case Customer objects to the subprocessing, Avanan can choose to either not engage the subprocessor or to terminate the Avanan DPA with two (2) months prior written notice.

6.4 Subject to Avanan complying with the obligations under Clause 11 SCC and Art. 28 para 2 GDPR, Customer herewith agrees to the following subprocessors:

• Amazon AWS