<!--oferta-page:1-->

Data Processing Agreement

Posted: August 23, 2024 Prior Version: October 28, 2022

This Data Processing Agreement (the 'DPA') supplements the Dropbox Services Agreement ('Agreement') between Dropbox and the customer that has executed or agreed to the Agreement ('Customer'). Capitalized terms used, but not defined, in this DPA are defined in the Agreement.

1. Nature of the Data and Role of the Parties. The rights and obligations in this DPA apply solely to the Processing of Personal Data by the Services by Dropbox on behalf of Customer. For the purposes of this DPA, references to Customer Data shall mean any Personal Data incorporated in the Customer Data.

2. Data Processing.

• 2.1. Instructions. The Agreement and this DPA constitute Customer's instructions to Dropbox to Process Customer Data. Dropbox will use and Process Customer Data as Customer instructs in order to deliver the Services and to fulfill Dropbox's obligations under the Agreement and this DPA. Dropbox will inform Customer of any legal requirement which prevents it from complying with Customer's instructions, unless prohibited from doing so by applicable law or on important grounds of public interest.
• 2.2. Processing Activities. Dropbox, Dropbox personnel, and Sub-processors will only Process Customer Data to provide the Services and to fulfill Dropbox's obligations in this Agreement. The categories of Personal Data to be Processed by Dropbox and the Processing activities to be performed under this Agreement are set out in Exhibit A.
• 2.3. Personnel. Any Dropbox personnel who have access to Customer Data will be bound by appropriate confidentiality obligations.

3. Security.

• 3.1. Security Measures. Dropbox will implement the technical and organizational measures set forth in the Agreement for the applicable Services.
• 3.2. Security Incidents. Dropbox will promptly, and without undue delay, notify Customer in writing at the email address associated with the account if a Security Incident occurs, so long as applicable law allows this notice. Without limiting the foregoing, Dropbox will use commercially reasonable efforts to provide this notice within 72 hours of confirming the existence of a Security Incident. Dropbox may limit the scope of, or refrain from delivering, any disclosures to the extent reasonably necessary to avoid compromising the integrity of Dropbox's security, an ongoing investigation, or any Dropbox customer's or end user's data. 'Security Incident' means any actual unauthorized disclosure of or access to Customer Data, or compromise of Dropbox's systems that Dropbox determines is reasonably likely to result in such disclosure or access, caused by failure of Dropbox's Security Measures and excluding any unauthorized disclosure or access that is caused by Customer or its End Users, including Customer or its End Users' failure to adequately secure equipment or accounts.
• 3.3. Notification. Dropbox will assist the Customer in ensuring compliance with its obligations pursuant to EU Data Protection Laws by providing relevant information which may include: (a) the nature of the Security Incident, including, where possible, the categories and approximate number of personal data records concerned; (b) the likely consequences of the Security Incident; (c) the measures taken or to be taken to address the Security Incident, including, where appropriate, the measures to mitigate its possible adverse effects; (d) the name and contact details of the Data Protection Officer or other contact from whom more information may be obtained; and (e) justifications for any delay in notification;. Should it not be feasible for Dropbox to provide all of the relevant information in its initial notification to the Customer, Dropbox will provide further relevant details without undue delay.