Personal data processed byOneTrusttypically includes: (a) identification data such as user account information including name, username, email, contact details, job title, and IP address; (b) information of end users interacting with the Services, such as IP address, UID, user preferences, or geolocation (optional); (c) information voluntarily disclosed by the data subjects when using the Services; and (d) any personal data submitted to the Services or toOneTrustor its Affiliates in the course of performing the Services.

Personal data is primarily processed for the purpose of providing the Services to Customer under the Agreement andcomplying withOneTrust’s obligations under the Agreement.

Customer’s employees, contractors, agents, consultants, vendors, customers and web visitors, whose personal data is processed byOneTrustfor the purposes of providing and Customer using the Services, including end users using or interacting with the Services.

The personal data processed may be subject to the following basic processing activities: collect, record, organize, store, adapt, alter, retrieve, redact, consult, use, align or combine, block, erase or destruct, disclose by transmission, disseminate, or otherwise make available Data as described herein, as strictly necessary and required to provide the Services and otherwise in accordance with Customer’s instructions.

Specifically, processing operations include:

▪Processing initiated by users throughuseof the Services.

▪Processing of name and e-mail addresses to provide login credentials, processing of IP to access and interact with the Cloud Services, processing of name and e-mail address to provide support and help desk, storage of login credentials of users for authentication purposes.

▪Hosting Customer environment whichcontainsData.