Corporate Solutions Services Appendices

APPENDIX 1

Processing Details

1. LIST OF PARTIES

DATA IMPORTER(S)

Contact Details for all Affiliate Data Importers:

By e-mail: privacy@nasdaq.com

By postal mail at:

Office of General Counsel – Privacy Team 
Nasdaq, Inc. 
805 King Farm Blvd 
First Floor 
Rockville, MD 20850

Office of General Counsel – Stockholm Office 
Tullvaktsvägen 15, 
10578 Stockholm 
Sweden

2. DESCRIPTION OF THE TRANSFER

2.1 Categories of data subjects whose personal data is transferred

• Customer may submit Customer Personal Data to the Services (as determined and controlled by the Customer in its sole discretion subject to any constraints set forth in the Agreement), which may relate to the following categories of Data Subjects:

• Employees, agents, advisors, directors, shareholders, customers and vendors of Customer (in each case, who are natural persons)

  Current and prospective investors and/or their representatives

  Independent reviewers or analysts of Customer or its personnel

  Users authorized by Customer to access and use the Services

  Any other category of Data Subjects whose Personal Data is contained or embedded within the data, information, and materials Customer submits to the Services or has Corporate Solutions (or another third party) submit into the Services on its behalf

  Any other category of Data Subjects whose Personal Data is contained or embedded within the data, information, and materials Customer submits to the Services or has Corporate Solutions acquire on its behalf

2.2 Categories of personal data transferred

• Customer may submit Customer Personal Data to the Services (as determined and controlled by the Customer in its sole discretion subject to any constraints set forth in the Agreement), which may relate to the following categories of Personal Data:

•  First and last name, title, position, employment-related information

  Contact information (company, email, phone, physical business address)

  Ownership interest in Customer

  Any other category of Personal Data contained within the data, information, and materials Customer submits to the Services or has Corporate Solutions (or another third party) submit into the Services on its behalf

2.3 Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialized training), keeping a record of access to the data, restrictions for onward transfers or additional security measures.

• In the general course of using the Services, Corporate Solutions does not anticipate that Customer will provide any Special Data Categories to Corporate Solutions. However, subject to Section 2.9 of the DPA, Customer may submit Special Data Categories to the Services (as determined and controlled by Customer in its sole discretion).

2.4 The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis).

• Corporate Solutions transfers Customer Personal Data in accordance with Customer’s instructions as set forth Section 2.5 and Section 2.6 of the DPA. The frequency of such transfers is determined and controlled by Customer in its sole discretion.

2.5 Nature of the processing

• The Processing of Customer Personal Data in order to provide the Services to Customer.

2.6 Purpose(s) of the data transfer and further processing

• Corporate Solutions Processes Customer Personal Data, including any necessary Restricted Transfers, for the purpose of providing the Services.

2.7 The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period

• Corporate Solutions will retain Customer Personal Data for the duration agreed upon by the Parties in the Agreement.

2.8 For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing

• The subject matter and nature of any Processing conducted by a Sub-Processor shall be as set forth in Appendix 3 (Sub-Processors) to the DPA. The duration of any Processing conducted by a Sub-Processor shall be as set forth in Section 2.7 of this Appendix 1 (Processing Details).

3. COMPETENT SUPERVISORY AUTHORITY

3.1 Identify the competent supervisory authority/ies in accordance with Clause 13

• For Clause 13 (Supervision), the Supervisory Authority with responsibility for ensuring compliance by the data exporter with the GDPR with regard to Restricted Transfers, namely, the lead Supervisory Authority of the data exporter, shall act as the competent Supervisory Authority.

APPENDIX 2

Information Security Program

Taking into account the nature, scope, context and purpose of the Processing, and the risks for the rights and freedoms of natural persons. Corporate Solutions has implemented, and will maintain, a comprehensive written information security program ("Information Security Program") with respect to the Customer Personal Data transferred to or received by Corporate Solutions in performance of the Services that includes administrative, technical, and physical safeguards to ensure the confidentiality, security, integrity, and availability of Customer Personal Data and to protect against unauthorized access, use, disclosure, alteration or destruction of Customer Personal Data.

In particular, the Information Security Program will include the following safeguards where appropriate or necessary to ensure the protection of Customer Personal Data:

Measures of pseudonymisation and encryption of personal data

• Access Controls – policies, procedures, and physical and technical controls to encrypt and decrypt Customer Personal Data where appropriate.

Measures for ensuring ongoing confidentiality, integrity, availability and resilience of processing systems and services

• Information Security Program – a comprehensive written information security program that includes administrative, technical, and physical safeguards to ensure the confidentiality, security, integrity, and availability of Customer Personal Data and to protect against unauthorized access, use, disclosure, alteration or destruction of Customer Personal Data.
• Contingency Planning – policies and procedures for responding to an emergency or other occurrence (for example, fire, vandalism, system failure, and natural disaster) that damages Customer Personal Data or systems that contain Customer Personal Data, including a data backup plan and a disaster recovery plan.

Measures for ensuring the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident

• Security Incident Procedures – policies and procedures to detect, respond to, and otherwise address security incidents, including procedures to monitor systems and to detect actual and attempted attacks on or intrusions into Customer Personal Data or information systems relating thereto, and procedures to identify and respond to suspected or known security incidents, mitigate harmful effects of security incidents, and document security incidents and their outcomes.
• Contingency Planning – policies and procedures for responding to an emergency or other occurrence (for example, fire, vandalism, system failure, and natural disaster) that damages Customer Personal Data or systems that contain Customer Personal Data, including a data backup plan and a disaster recovery plan.

Processes for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures in order to ensure the security of the processing

• Testing – The data importer will regularly test the key controls, systems and procedures of its Information Security Program to ensure that they are properly implemented and effective in addressing the threats and risks identified. Tests should be conducted or reviewed by independent third parties or staff independent of those that develop or maintain the security programs.

Measures for user identification and authorization

• Access Controls – policies, procedures, and physical and technical controls: (i) to limit physical access to its information systems and the facility or facilities in which they are housed to properly authorized persons; (ii) to ensure that all members of its workforce who require access to Customer Personal Data have appropriately controlled access, and to prevent those workforce members and others who should not have access from obtaining access; and (iii) to authenticate and permit access only to authorized individuals and to prevent members of its workforce from providing Customer Personal Data or information relating thereto to unauthorized individuals.
• Data Integrity – policies and procedures to ensure the confidentiality, integrity, and availability of Customer Personal Data and protect it from disclosure, improper alteration, or destruction.

Measures for the protection of data during transmission

• Storage and Transmission Security – technical security measures to guard against unauthorized access to Customer Personal Data that is being transmitted over an electronic communications network, including a mechanism to encrypt Customer Personal Data in electronic form while in transit and in storage on networks or systems to which unauthorized individuals may have access.

Measures for the protection of data during storage

• Storage Media – policies and procedures to ensure that prior to any storage media containing Customer Personal Data being assigned, allocated or reallocated to another user, or prior to such storage media being permanently removed from a facility, the data importer will delete such Customer Personal Data from both a physical and logical perspective, such that the media contains no residual data, or if necessary physically destroy such storage media. The data importer will maintain an auditable program implementing the disposal and destruction requirements set forth in this section for all storage media containing Customer Personal Data.

Measures for ensuring physical security of locations at which personal data are Processed

• Information Security Program – a comprehensive written information security program that includes administrative, technical, and physical safeguards to ensure the confidentiality, security, integrity, and availability of Customer Personal Data and to protect against unauthorized access, use, disclosure, alteration or destruction of Customer Personal Data

Measures for ensuring events logging

• Audit Controls – hardware, software, and/or procedural mechanisms that record and examine activity in information systems that contain or use electronic information, including appropriate logs and reports concerning these security requirements and compliance therewith.

Measures for ensuring system configuration, including default configuration

• Audit Controls – hardware, software, and/or procedural mechanisms that record and examine activity in information systems that contain or use electronic information, including appropriate logs and reports concerning these security requirements and compliance therewith.

Measures for internal IT and IT security governance and management

• Assigned Security Responsibility – The data importer will designate a security official responsible for the development, implementation, and maintenance of its Information Security Program. The data importer will inform Customer as to the person responsible for security.
• Adjust the Program – The data importer will monitor, evaluate, and adjust, as appropriate, the Information Security Program in light of any relevant changes in technology or industry security standards, the sensitivity of the Customer Personal Data, internal or external threats to the data importer or the Customer Personal Data, and the data importer's own changing business arrangements, such as mergers and acquisitions, alliances and joint ventures, outsourcing arrangements, and changes to information systems. In light of the foregoing, the Information Security Program is subject to change; provided, however, that any such update will not lessen the applicable information security protections.

Measures for certification/assurance of processes and products

• Testing – The data importer will regularly test the key controls, systems and procedures of its Information Security Program to ensure that they are properly implemented and effective in addressing the threats and risks identified. Tests should be conducted or reviewed by independent third parties or staff independent of those that develop or maintain the security programs.
• Adjust the Program – The data importer will monitor, evaluate, and adjust, as appropriate, the Information Security Program in light of any relevant changes in technology or industry security standards, the sensitivity of the Customer Personal Data, internal or external threats to the data importer or the Customer Personal Data, and the data importer's own changing business arrangements, such as mergers and acquisitions, alliances and joint ventures, outsourcing arrangements, and changes to information systems. In light of the foregoing, the Information Security Program is subject to change; provided, however, that any such update will not lessen the applicable information security protections.

Measures for ensuring data quality

• Data Integrity – policies and procedures to ensure the confidentiality, integrity, and availability of Customer Personal Data and protect it from disclosure, improper alteration, or destruction.

Measures for ensuring limited data retention

• Device and Media Controls – policies and procedures on hardware and electronic media that contain Customer Personal Data into and out of a data importer facility, and the movement of these items within a data importer facility, including policies and procedures to address the final disposition of Customer Personal Data, and/or the hardware or electronic media on which it is stored, and procedures for removal of Customer Personal Data from electronic media before the media are made available for re-use.
• Storage Media – policies and procedures to ensure that prior to any storage media containing Customer Personal Data being assigned, allocated or reallocated to another user, or prior to such storage media being permanently removed from a facility, the data importer will delete such Customer Personal Data from both a physical and logical perspective, such that the media contains no residual data, or if necessary physically destroy such storage media. The data importer will maintain an auditable program implementing the disposal and destruction requirements set forth in this section for all storage media containing Customer Personal Data.

Measures for ensuring accountability

• Security Awareness and Training – a security awareness and training program for all members of the data importer's workforce (including management), which includes training on how to implement and comply with its Information Security Program
• Audit Controls – hardware, software, and/or procedural mechanisms that record and examine activity in information systems that contain or use electronic information, including appropriate logs and reports concerning these security requirements and compliance therewith.

Measures for allowing data portability and ensuring erasure

• Device and Media Controls – policies and procedures on hardware and electronic media that contain Customer Personal Data into and out of a data importer facility, and the movement of these items within a data importer facility, including policies and procedures to address the final disposition of Customer Personal Data, and/or the hardware or electronic media on which it is stored, and procedures for removal of Customer Personal Data from electronic media before the media are made available for re-use.

For transfers to (sub-) processors, also describe the specific technical and organizational measures to be taken by the (sub-) processor to be able to provide assistance to the controller and, for transfers from a processor to a sub-processor, to the data exporter

• Corporate Solutions shall ensure Sub-Processors provide technical and organizational measures no less protective than those set forth in the DPA, including this Appendix 2 (Information Security Program).

APPENDIX 3

Sub-Processors

THIRD-PARTY SUB-PROCESSORS

NASDAQ BOARDVANTAGE

As of the Effective Date of the DPA, Corporate Solutions has not appointed any Sub-Processors for the purpose of providing the Nasdaq Boardvantage Service.

DIRECTORS DESK

As of the Effective Date of the DPA, Corporate Solutions has not appointed any Sub-Processors for the purpose of providing the Directors Desk Service.

CORPORATE SOLUTIONS AFFILIATE SUB-PROCESSORS

Contact Details for all Affiliate Sub-Processors:

By e-mail: privacy@nasdaq.com

By postal mail at:

Office of General Counsel – Privacy Team 
Nasdaq, Inc. 
805 King Farm Blvd 
First Floor 
Rockville, MD 20850

Office of General Counsel – Stockholm Office 
Tullvaktsvägen 15, 
10578 Stockholm 
Sweden