New Relic Data Processing Addendum Addendum New Relic HOW . - Infomedia

DocuSign Envelope ID: 88FFA6E6-14B3-4756-B780-3524EC2675BB7.3Personal Data Breach Response. New Relic shall notify Customer without undue delay after becomingaware of a Personal Data Breach. To the extent that Customer requires additional information in orderto meet its Personal Data Breach notification obligations under EU Data Protection Laws, New Relicshall provide timely information relating to the Personal Data Breach as it becomes known or as isreasonably requested by Customer. Where and insofar as it is not possible to provide the informationat the same time as the notification, New Relic shall provide the information in phases without furtherundue delay.7.4Personal Data Breach Investigation. New Relic shall, without undue delay, commence an investigationof a Personal Data Breach and take appropriate remedial steps to prevent and minimize any possibleharm. For the avoidance of doubt, Personal Data Breaches will not include unsuccessful attempts to,or activities that do not, compromise the security of Personal Data without limitation, unsuccessfullogin attempts, denial of service attacks and other attacks on firewalls or networked systems.8.8.1International TransfersData Regions. New Relic’s data regions are located in the US and the EU, as further described in theDocumentation. Personal Data held in Customer’s Account in the Services environment will be hostedin the data region selected by Customer during the provisioning of the Account. New Relic will notmigrate your Account in the Services environment to another data region without Customer’s priorconsent.8.2Operational Access and Processing. Without prejudice to Section 8.1, New Relic may access andProcess Personal Data in the U.S. as necessary to maintain, secure, or perform the Services, fortechnical support, or as necessary to comply with law or a binding order of a government body asfurther described in Section 14 (Law Enforcement Requests). New Relic may also engage SubProcessors as further described in Section 9 (Sub-Processing).8.3Personal Data Transfer Mechanism. New Relic agrees to abide by and process the Personal Data incompliance with the Model Clauses in the form set forth in Exhibit 3-Model Clauses of this Addendum.For the purposes of the Model Clauses, the parties agree that New Relic is a “data importer” andCustomer is the “data exporter” (notwithstanding that the Customer may be an entity located outsidethe EEA). If the Model Clauses apply, Customer agrees that the Model Clauses constitute New Relic'sConfidential Information as that term is defined in the Agreement and may not be disclosed byCustomer to any third party without New Relic's prior written consent unless permitted pursuant toAgreement. This shall not prevent disclosure of the Model Clauses to a Data Subject pursuant toClause 4(h) or a supervisory authority pursuant to Clause 8 of the Model Clauses. In the event that theModel Clauses are no longer accepted as a valid transfer mechanism, the parties shall ensure that anysubsequent transfer of Personal Data is in accordance with applicable law.8.4Suspension of Transfer. Where the Model Clauses apply, the parties acknowledge that New Relic mayprocess the Personal Data only on behalf of Customer and in compliance with Customer’s instructionsand the Clauses. If New Relic becomes aware that it cannot provide such compliance it agrees topromptly inform Customer of its inability to comply, and Customer will be entitled to suspend thetransfer of data under the Model Clauses. If Customer intends to suspend the transfer of personaldata it shall provide notice to New Relic within a reasonable period of time to cure the non-compliance(“Cure Period”). If, after the Cure Period, New Relic has not or cannot cure the non-compliance,Customer may suspend or terminate the transfer of Personal Data immediately. Customer shall notbe required to provide such notice where it considers there is a material risk of harm to Data Subjectsor their personal data.4

DocuSign Envelope ID: 88FFA6E6-14B3-4756-B780-3524EC2675BB9.GDPR Article 28 (3) (D): Sub-Processing9.1Authorized Sub-Processors. Customer acknowledges and expressly agrees that New Relic may engageSub-Processors to process Personal Data in connection with the provision of the service. New Relic willprovide a list of current Sub-Processors upon request. Where the Model Clauses apply, the partiesacknowledge that Customer may provide a general consent to onward sub-processing by New Relic.Accordingly, Customer provides a general consent to New Relic, pursuant to Clause 11 of the ModelClauses, to engage onward Sub-Processors. Such consent is conditional on New Relic’s compliance withthe requirements set out in this Section 9.9.2Changes to Sub-Processors. Provided that Customer signs up for notifications essors, New Relic shall provide prior notice of anynew third-party Sub-Processors. After being notified, Customer will have ten (10) business days tonotify New Relic in writing of any reasonable objection it has to the new third-party Sub-Processor(s).Failure to notify New Relic within this time frame will be deemed approval of the new third-party SubProcessor(s). In the event Customer provides reasonable objection, New Relic will use reasonableefforts to make a change in the service or Customer’s configuration available to avoid processing ofPersonal Data by such third-party Sub-Processor. If New Relic is unable to make available such changewithin a reasonable period of time, which shall not exceed sixty (60) days, Customer may terminate theapplicable order with respect to the affected service that cannot be provided without use of therejected third-party Sub-Processor.9.3Sub-Processor Obligations. In the event New Relic engages a Sub-Processor to carry out specificprocessing activities on behalf of Customer, New Relic shall conduct appropriate due diligence andsecurity review prior to engaging that Sub-Processor and shall place substantially similar obligations tothis Addendum on such Sub-Processor. Where such additional Sub-Processor fails to fulfill its dataprotection obligations, New Relic shall remain fully liable to Customer for the performance of that SubProcessor’s obligations.9.4Copies of Sub-Processor Agreements. Where the Model Clauses apply, the parties acknowledge that,pursuant to Sub-Processor confidentiality restrictions, New Relic may be restricted from disclosingonward Sub-Processor agreements to Customer pursuant to Clause 5(J) of the Model Clauses. New Relicshall use reasonable efforts to require its’ Sub-Processor to permit it to disclose that agreement toCustomer. Where New Relic is unable to disclose the agreement, the parties agree that, uponCustomer’s request, New Relic shall (on a confidential basis) provide all reasonable information inconnection with such agreement to Customer.10.GDPR Article 28 (3) (E): Cooperation10.1Data Subjects and Data Protection Authorities Requests. To the extent that Customer is unable toindependently access the relevant Personal Data within the Services and, taking into account the natureof the processing, New Relic will (at Customer's expense) use reasonable efforts to assist Customer inresponding to requests by Data Subjects or applicable data protection authorities relating to theprocessing of Personal Data under the Agreement. In the event that any such request is made directlyto New Relic, New Relic shall not respond to such communication directly without Customer's priorauthorization, unless legally compelled to do so or if New Relic cannot identify the relevant Customer(s).If New Relic is required to respond to such a request, New Relic shall promptly notify Customer andprovide it with a copy of the request unless legally prohibited from doing so.5

DocuSign Envelope ID: 88FFA6E6-14B3-4756-B780-3524EC2675BB10.2Data Protection Impact Assessments. To the extent New Relic is required under Data Protection Law,New Relic will (at Customer's expense) provide reasonably requested information regarding New Relic'sprocessing of Personal Data under the Agreement to enable the Customer to carry out data protectionimpact assessments or prior consultations with data protection authorities as required by law.11.GDPR Article 28 (3) (F): Other Obligations11.1Taking into account the nature of the processing under this Addendum, New Relic shall take allreasonable steps to assist Customer in meeting Customer’s obligations under Articles 32 to 26 of GDPRas set out in this Addendum at Section 7 ‘Security’ and Section 10 ‘Co-operation’. New Relic andCustomer agree that, for the purposes of Article 30 GDPR, this Addendum and Exhibit 1 constitute therecord of the categories of processing activities carried out by New Relic on behalf of Customer.12.GDPR Article 28 (3) (G): Return or Deletion of Data12.1Upon receipt of Customer’s written request, New Relic shall (at Customer's election) return PersonalData or close Customer’s account and delete all Personal Data within 90 days of the termination, savethat this requirement shall not apply to the extent New Relic is required by applicable law to retainsome or all of the Personal Data, which Personal Data New Relic shall securely isolate and protect fromany further processing, except to the extent required by applicable law. Customer may uninstall theNew Relic software agent at any time to cease processing of new information.13.GDPR Article 28 (3) (H): Security Reports and Audits.13.1Customer may audit New Relic’s compliance with the terms of this Addendum once annually. Customermay elect to perform such an audit on its own behalf or pursuant to a formal direction or request forinformation from a supervisory authority to which Customer is subject.13.2Where requested by Customer in writing, subject to the confidentiality obligations set forth in theAgreement, New Relic shall make available to Customer (or Customer’s independent, third-partyauditor that is not a competitor of New Relic) information regarding New Relic’s compliance with theobligations set forth in this Addendum in the form of the third-party certifications and audits describedat https://www.newrelic.com/security.13.3Upon review of such materials as described in Section 13.2, if Customer identifies areas that have notbeen covered that it is lawfully permitted to audit under this Addendum, then Customer may submitreasonable requests for information security and audit questionnaires that are necessary to confirmNew Relic’s compliance with this Addendum, provided that Customer shall not exercise this right morethan once per year.13.4Where the Model Clauses apply, the parties agree and acknowledge that Customer exercises its auditright under Clause 5 (F) of the Model Clauses by instructing New Relic to comply with the auditmeasures described in this Section 13.14.Law Enforcement Requests14.1If a law enforcement agency sends New Relic a demand for Personal Data, New Relic shall attempt toredirect the law enforcement agency to request that data directly from Customer. As part of this effort,New Relic may provide Customer’s basic contact information to the law enforcement agency. Ifcompelled to disclose Personal Data to a law enforcement agency, then New Relic shall give Customer6

DocuSign Envelope ID: 88FFA6E6-14B3-4756-B780-3524EC2675BBreasonable notice of the demand to allow Customer to seek a protective order or other appropriateremedy unless New Relic is legally prohibited from doing so.Accepted and agreed to as of the date below by the authorized representative of each party:Infomedia Ltd and its subsidiaries IFM Europe LtdIFM Americas Inc and Nidasu Pty LtdCUSTOMER:NEW RELIC, INC.By:By:Name:Mark GrodzickyAngel ZhaoName:Company SecretaryTitle:CAOTitle:13 January 2021Date:77/20/2020Date:

DocuSign Envelope ID: 88FFA6E6-14B3-4756-B780-3524EC2675BBExhibit 1 – Details of Processing(a)Subject matter: The subject matter of the data processing under this Addendum is the Personal Data.(b)Duration. The duration of the processing under this Addendum is determined by the Agreement.(c)Purpose. The purpose of the processing under the Addendum is the provision of the Service by NewRelic to Customer as specified in the Agreement.(d)Nature of the processing. New Relic is providing performance monitoring and analytics services forapplications, infrastructure systems, mobile applications, browser and client-side software, and otherdigital systems, as specified in the applicable order and in the Agreement. These Services may includethe processing of Personal Data by New Relic as determined by Customer in the configuration of theService.(e)Categories of Data Subjects. Data Subjects who interact with the software, system or applicationCustomer has chosen to monitor and perform analytics on using the Service, which may include (butare not limited to) Customer’s users and customers or as otherwise determined by Customer in theconfiguration of the Service.(f)Categories of data. Personal Data that is submitted to the Service by Customer, which may include,but is not limited to, IP address, username, and other types of identifiable data configured byCustomer, subject to the restrictions in the Agreement.(g)Special Categories of Data. In accordance with the Agreement, the Customer is contractuallyprohibited from sending special categories of data, as defined by GDPR, to the Service.8

DocuSign Envelope ID: 88FFA6E6-14B3-4756-B780-3524EC2675BBExhibit 2 – SecurityNew Relic will maintain administrative, physical and technical safeguards for protection of the security,confidentiality, and integrity of Personal Data transmitted to the Service, as described in the New RelicSecurity Policy, as updated from time to time, and located and accessible via the Documentation. Pleasesee formation/referenced-policies/security-policy.9

DocuSign Envelope ID: 88FFA6E6-14B3-4756-B780-3524EC2675BBExhibit 3 to the New Relic GDPR AddendumEU STANDARD CONTRACTUAL CLAUSESController to Processor export of personal data (from EEA countries)For the purposes of Article 26(2) of Directive 95/46/EC for the transfer of personal data to processorsestablished in third countries which do not ensure an adequate level of data protectionName of the data exporting organisation:Address:Tel.:Infomedia Ltd including its subsidiaries IFM Europe Ltd,IFM Americas Inc and Nidasu Pty. Ltd3 Minna Close, Belrose, NSW, 2086 Australia61 2 9454 1500; fax:N/A;e-mail:privacy@infomedia.com.auOther information needed to identify the organisation:Infomedia Ltd and its subsidiaries (as listed above) (the data exporter)AndName of the data importing organisation: New Relic, Inc.Address: 188 Spear Street, Suite 1200 San Francisco, CA 94105E-mail: legal@newrelic.comOther information needed to identify the organisation: (the data importer)each a “party”; together “the parties”,HAVE AGREED on the following Contractual Clauses (the Clauses) in order to adduce adequatesafeguards with respect to the protection of privacy and fundamental rights and freedoms of individualsfor the transfer by the data exporter to the data importer of the personal data specified in Appendix 1.10

DocuSign Envelope ID: 88FFA6E6-14B3-4756-B780-3524EC2675BBClause 1DefinitionsFor the purposes of the Clauses:(a)'personal data', 'special categories of data', 'process/processing', 'controller','processor', 'data subject' and 'supervisory authority' shall have the same meaning as inDirective 95/46/EC of the European Parliament and of the Council of 24 October 1995 on theprotection of individuals with regard to the processing of personal data and on the freemovement of such data;(b)'the data exporter' means the controller who transfers the personal data;(c)'the data importer' means the processor who agrees to receive from the data exporterpersonal data intended for processing on his behalf after the transfer in accordance with hisinstructions and the terms of the Clauses and who is not subject to a third country's systemensuring adequate protection within the meaning of Article 25(1) of Directive 95/46/EC;(d)'the subprocessor' means any processor engaged by the data importer or by any othersubprocessor of the data importer who agrees to receive from the data importer or from anyother subprocessor of the data importer personal data exclusively intended for processingactivities to be carried out on behalf of the data exporter after the transfer in accordancewith his instructions, the terms of the Clauses and the terms of the written subcontract;(e)'the applicable data protection law' means the legislation protecting the fundamentalrights and freedoms of individuals and, in particular, their right to privacy with respect to theprocessing of personal data applicable to a data controller in the Member State in which thedata exporter is established;(f)'technical and organisational security measures' means those measures aimed atprotecting personal data against accidental or unlawful destruction or accidental loss,alteration, unauthorised disclosure or access, in particular where the processing involves thetransmission of data over a network, and against all other unlawful forms of processing.Clause 2Details of the transferThe details of the transfer and in particular the special categories of personal data where applicable arespecified in Appendix 1 which forms an integral part of the Clauses.Clause 3Third-party beneficiary clause1.The data subject can enforce against the data exporter this Clause, Clause 4(b) to (i),Clause 5(a) to (e), and (g) to (j), Clause 6(1) and (2), Clause 7, Clause 8(2), and Clauses 9 to 12as third-party beneficiary.2.The data subject can enforce against the data importer this Clause, Clause 5(a) to (e)and (g), Clause 6, Clause 7, Clause 8(2), and Clauses 9 to 12, in cases where the data exporterhas factually disappeared or has ceased to exist in law unless any successor entity hasassumed the entire legal obligations of the data exporter by contract or by operation of law,11

DocuSign Envelope ID: 88FFA6E6-14B3-4756-B780-3524EC2675BBas a result of which it takes on the rights and obligations of the data exporter, in which casethe data subject can enforce them against such entity.3.The data subject can enforce against the subprocessor this Clause, Clause 5(a) to (e)and (g), Clause 6, Clause 7, Clause 8(2), and Clauses 9 to 12, in cases where both the dataexporter and the data importer have factually disappeared or ceased to exist in law or havebecome insolvent, unless any successor entity has assumed the entire legal obligations of thedata exporter by contract or by operation of law as a result of which it takes on the rightsand obligations of the data exporter, in which case the data subject can enforce them againstsuch entity. Such third-party liability of the subprocessor shall be limited to its ownprocessing operations under the Clauses.4.The parties do not object to a data subject being represented by an association orother body if the data subject so expressly wishes and if permitted by national law.Clause 4Obligations of the data exporterThe data exporter agrees and warrants:(a)that the processing, including the transfer itself, of the personal data has been andwill continue to be carried out in accordance with the relevant provisions of the applicabledata protection law (and, where applicable, has been notified to the relevant authorities ofthe Member State where the data exporter is established) and does not violate the relevantprovisions of that State;(b)tha

1 New Relic Data Processing Addendum This Data Processing Addendum (Addendum _) including its Exhibits and Appendices forms part of the agreement (Agreement _) for the purchase of services between New Relic, Inc. a Delaware corporation with offices located at 188 Spear Street, Suite 1200, San Francisco, CA 94105 ( New Relic _) and the entity identified as Customer on