The subcontractor has the right to use subcontractors and the controller accepts the use of subcontractors. A list of pre-approved subcontractors is available at the SuperOffice Trust Center. The processor shall ensure, by written agreement with a processor, that any processing of personal data by subcontractors is subject to the same obligations and restrictions as those imposed on the processor under this data processing agreement. Even if you have outsourced the processing of personal data, you remain responsible for this processing. You cannot outsource your legal obligations and failure to comply with these obligations can have serious consequences. The technical and organisational security measures implemented by the data importer are described in the DPA and in the agreement. With respect to Unify Cloud Services, this DPA takes precedence over any other existing data processing agreement or similar agreement between Unify and the customer that may already exist for other products, websites or services. 4.2.9 Consequences of deletion of personal data: The Customer hereby confirms and acknowledges that if the Customer requests Unify to delete or restrict their processing, this may make it impossible to provide the products or services provided or subscribed. Unify will inform the customer of these consequences before executing such a request. Appendix 4 Decision C(2010)593 Commission Standard Contractual Clauses (processors) For the purposes of Article 26(2) of Directive 95/46/EC on the transfer of personal data to processors established in third countries which do not ensure an adequate level of data protection Name of the data exporting organisation: customer within the meaning of the agreement.

. . .