1. Service Order Form

ANNEX [A]: SERVICE ORDER FORM

This Service Order Form ("Order Form") is entered into pursuant to the Agreement dated [Insert Date] (the "Agreement") between Customer and ____________("Contractor "). This Order Form is subject to the terms and conditions of the Agreement and guides the collection and processing of data according to the attached Data Processing Addendum.

1. Purpose of the Service

The primary objective of these services is manage projects such as: social media, advertising, media, reporting, outreach campaigns, communication, community management, consulting and other related services. (the “Purpose of the Service”).

.

2. Data Protection & Privacy

In performance of the Services, the following Customer data will be processed:

3. Contractor data protection Point of Contact:

Name: __________________________   Role:: __________ Contact details: __________

4. Authorization

By signing below, the parties agree to the terms of this Order Form.

Customer Signature: __________________________    Date: __________

Contractor Signature: __________________________    Date: __________

2. Data Processing Addendum

Version 1 July 2026

Data Processing Addendum

(according to the Israeli PPL)

This Data Processing Agreement (“DPA”) is incorporated into and forms part of (and if applicable, amends the current version of) the agreement between the Parties and any associated contractual document between the Parties, such as an order form, statement of work, or other terms thereunder (collectively, the “Agreement”), between Taglit BRI and/or its Affiliates identified in the Agreement (“Customer”), and the Contractor providing the Services to Customer, as identified in the signature block of this DPA (“Contractor” or "Supplier"), each a “Party” and collectively the “Parties.” This DPA applies to and takes precedence over the Agreement to the extent of any conflict. Capitalized terms not defined herein are defined as in applicable Data Protection Laws.

Customer and Contractor agree as follows:

1. Definitions. For purposes of this DPA:

   1. “Affiliate” means any entity that directly or indirectly controls, is controlled by, or is under common control with a party to this DPA, where “control” refers to direct or indirect ownership or control of more than 50% of the voting interests of the subject entity.

   2. “Data Protection Laws” means all applicable laws, regulations, and other legal or self-regulatory requirements in any jurisdiction relating to privacy, data protection, data security, breach notification, or the Processing of personal data, including without limitation, the General Data Protection Regulation, Regulation (EU) 2016/679 (“GDPR”); the Israeli Protection of Privacy Law 5741-1981 ("PPL") and regulations according to the PPL; US Privacy Laws. For the avoidance of doubt, unless specified otherwise, references to “Data Protection Laws” herein mean Data Protection Laws that are applicable in a given situation, or with regard to specific collection or processing.

   3. “Data Subject” means an identified or identifiable natural person to whom Personal Data relates, and is deemed to also refer to “consumer” as defined in Data Protection Laws.

   4. “EU SCCs” means the Standard Contractual Clauses issued pursuant to Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council, available at http://data.europa.eu/eli/dec_impl/2021/914/oj and completed as set forth herein.

   5. “Personal Data” includes “personal data,” “personal information,” “personally identifiable information,” and analogous terms, as defined by applicable Data Protection Laws, that Contractor Processes in relation to the Agreement.

   6. “Process” and its cognates “Processing,” “Processed,” etc. mean any operation or set of operations performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organization, creating, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.

   7. "Processing purpose" – as described in the Agreement or the SOW.

   8. “Security Breach” as defined in the Information Security Policy. means any accidental or unlawful acquisition, destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data.

   9. "Security Incident" – means "Security Breach" and any indication of a possible "Security Breach" even before Contractor has verified that a "Security Breach" has occurred.

   10. “Services” means the services that Contractor performs on behalf of Customer pursuant to the Agreement and according to the Statement of Work (SOW).

   11. “Subprocessor” means any third party or Contractor Affiliate that Contractor engages to Process Personal Data.

   12. "U.S. Privacy Laws": All U.S. federal or state privacy statutes in force, including privacy, data protection, and data security laws and regulations issued by a governmental authority of any US state jurisdiction applicable to the Processing of Customer Personal Data under DPA.

   13. Customer Personal Data – Any Personal Data that is collected by the Contractor or provided to the Contractor by Customer as part of providing the Services to Customer .

2. General

   1. Contractor acknowledges that the terms set forth herein are required to ensure Customer’s compliance with Regulation 15(a)(2) of Israel’s Protection of Privacy (Data Security) Regulations, 5777-2017, which prescribes specific contractual arrangements a Database Controller (as defined below) must establish with any external service provider engaged to perform a service that involves the Processing of Personal Data on its behalf.

   2. The term of the Parties’ engagement is as set forth in the Agreement, and the term of this DPA. The Parties agree that this DPA shall also apply to all Personal Data in Contractor’s possession or control as of the date this DPA takes effect, including any such data made available to, transferred to, created, or received by Contractor on behalf of Customer before that date, to ensure compliance with the PPL.

   3. This DPA shall be interpreted in favor of the Parties’ intent to comply with the PPL, and therefore any ambiguity shall be resolved in a manner that is consistent with the PPL.

3. Roles of the Parties; Scope and Purposes of Processing.

   1. This DPA applies to all Personal Data that Contractor Processes in relation to the Agreement.

   2. Contractor shall process Personal Data only as described in the SOW attached hereto, solely as a data Processor or as a Sub Processor, always acting on behalf of Customer and Customer shall be deemed the Controller or Processor of such Personal Data, respectively.

   3. Contractor will Process Personal Data solely (i) in compliance with Data Protection Laws, (ii) on Customer’s behalf; and (iii) to fulfill its obligations to Customer under the Agreement, including this DPA. For the avoidance of doubt, Contractor will Process Personal Data solely to provide the Services to Customer under the Agreement for the express Processing Purpose.

   4. Customer retains the right to take reasonable and appropriate steps to (i) ensure that Contractor Processes Personal Data in a manner consistent with Data Protection Laws, and (ii) upon notice, stop and remediate unauthorized Processing of Personal Data, including any use of Personal Data not expressly authorized in this DPA.

4. Personal Data Processing Requirements. Contractor will:

   1. Conduct all contacts or Personal Data collection from Data Subjects, as part of the performance of this agreement, according to Customer's specific guidelines.

   2. Not retain, use, or disclose Personal Data outside of the direct business relationship between Customer and Contractor, or for any purpose (including any commercial purpose) not set forth in this DPA.

   3. Not “sell” or “share” any Personal Data, or use Personal Data for purposes of “cross-context behavioral advertising” or “targeted advertising,” as such terms are defined in Data Protection Laws in the United States.

   4. Comply with any applicable restrictions under Data Protection Laws on combining Personal Data with personal data that Contractor receives from, or on behalf of, another person or persons, or that Contractor collects from any interaction between it and any individual. Will process Customer data such that it is stored and processed separately from other customers' data.

   5. Will cooperate in complying with applicable laws regarding legality of collection and processing, will inform Customer of detailed data collection and processing practices in order for Customer to guide Contractor regarding required privacy notices or processing activities. Contractor will remain responsible for any such collection and processing until it clearly informs Customer in writing about its processing operations, and receives its written instructions.

   6. Will not attempt to (i) re-identify any pseudonymized, anonymized, aggregate, or de-identified Personal Data, or (ii) link, identify, or otherwise create a relationship between Personal Data and any other data, without Customer’s express written permission.

   7. Not otherwise engage in any Processing of Personal Data that is prohibited or not permitted by Processors or Service Providers under Data Protection Laws, and specifically that is not for the Purpose as described in Annex A.

   8. Ensure that the persons it authorizes to Process the Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

   9. To the extent required by Data Protection Laws, provide Customer with reasonable assistance and cooperation for the fulfillment of Customer’s obligations under Data Protection Laws, including but not limited to Customer’s obligation to (i) respond to requests by Data Subjects (or their lawful representatives) to exercise their rights under Data Protection Laws with regard to their Personal Data; (ii) perform any required data protection impact assessment for Processing or proposed Processing of Personal Data; and (iii) consult with regulatory authorities in relation to the Processing or proposed Processing of Personal Data, including any applicable obligation upon Contractor to consult with a regulatory authority in relation to Contractor’s Processing or proposed Processing of Personal Data. Contractor will promptly, and in any event within three (3) days, notify Customer of any Data Subject or government requests regarding Contractor’s Processing of Personal Data on Customer’s behalf, and will await written instructions from Customer on how, if at all, to assist in responding.

   10. Immediately notify Customer if Contractor determines that (i) it can no longer meet its obligations under this DPA or Data Protection Laws; (ii) it has breached this DPA, and shall cooperate to remediate such breach; or (iii) in Contractor’s opinion, an instruction from Customer infringes Data Protection Laws.

5. Data Security.

   1. Contractor will implement appropriate technical and organizational measures to protect Personal Data, to ensure the security of the data, as required from Processors under Data Protection laws, and as set forth in the attached Exhibit C "Taglit Information Security Addendum"".

6. Security Incident and Breach.

   1. Contractor will notify Customer immediately of any Security Incident

   2. Without derogation of Contractor's liability to comply with this DPA and mitigate any Security Breach, Contractor will inform Customer about any measures to stop and remediate any Security Breach and coordinate such measures with Customer.

   3. Contractor will to the maximum extent possible coordinate with Customer any communications with any official authority regarding any security incident or breach.

   4. The Contractor shall not respond to requests from third parties pertaining to security incidents concerning Customer Data, and shall not, at its initiative, share details of the Data Security Incident without receiving the consent of Customer therefor, and shall enable it to defend itself before the Data is transferred to a third party and/or any official authority.

7. Subprocessors.

   1. Customer acknowledges and agrees that Contractor may use Subprocessors to Process Personal Data in accordance with this DPA and Data Protection Laws. Where Contractor sub-contracts any of its rights or obligations concerning Personal Data to a Subprocessor, Contractor will: (i) take steps to select and retain Subprocessors that are capable of maintaining appropriate privacy and security measures to protect Personal Data consistent with applicable Data Protection Laws; and (ii) enter into a written agreement with each Subprocessor requiring it to comply with obligations at least as restrictive as those imposed on Contractor under this DPA. Contractor shall be responsible for all actions and omissions of its Subprocessors as if they were committed by Contractor.(iii) will not share the nature of the Personal Data as affiliated with Customer, so as not to enable sub processor to link Customer Data with Jewish identity.

   2. Contractor shall be responsible for conducting a risk assessment and due diligence regarding the reliability of the subcontractor and its ability to comply with the terms of this addendum, to verify that there is no other risk of misuse of Personal Information in connection with this Schedule by the subcontractor, and to document this process. Documentation of the risk assessment shall be provided to Customer for review upon request

   3. Contractor will maintain an up-to-date list of its Subprocessors. The initial list is provided in Exhibit B of this DPA, and Customer consents to Contractor’s use of the Subprocessors on this list. Such details will include:

      1. Name of Subprocessor;

      2. Purpose of Service;

      3. Access to Customer data (y/n);

      4. Sub-Processing contract (date)

      5. Does contract include duty to inform of an information security incident as defined in this policy;

      6. Does contract include duty to delete data;

      7. Subproccesor POC

   4. Contractor will provide Customer with thirty (30) days’ notice of any new Subprocessor added to the list prior to providing the new Subprocessor with Personal Data or access thereto. If Customer reasonably objects to a new Subprocessor within that 30-day period, Contractor will not provide the Subprocessor with Personal Data or access thereto, and Contractor will use reasonable efforts to adjust the Services or recommend a commercially reasonable change to Customer’s use of the Services to avoid Processing of Personal Data by the objected-to Subprocessor without unreasonably burdening Customer. If Contractor is unable to do either of the foregoing to Customer’s satisfaction, Customer may, in its sole discretion, terminate the Services or that portion of the Services involving the objected-to Subprocessor on written notice to Contractor, and Contractor shall refund any prepaid and unused fees relating to the terminated Services.

   5. Contractor will provide copies of the Subprocessor agreements that must be sent to Customer pursuant to the EU SCCs upon Customer’s request. Contractor may remove or redact all commercial information or clauses unrelated to the EU SCCs or their equivalent before providing such agreements to Customer.

8. Use of Artificial Intelligence tools

   1. Contractor shall not use, disclose, or otherwise process any personal data (including pseudonymized, anonymized, or hashed data) provided by the Customer to develop, train, fine-tune, or improve any machine learning models, large language models (LLMs), or artificial intelligence architectures. All AI-driven processing operations must execute within a strictly transient, zero-retention environment and remain confined to the explicit, documented instructions of the Customer.

   2. Contractor warrants that no AI systems, predictive analytics, or clustering algorithms shall be deployed to infer, deduce, or cross-reference special category data of data subjects. The Contractor is strictly prohibited from utilizing any algorithmic tool to classify, tag, or profile identified data subjects based on implied or explicit religious beliefs or philosophical affiliations.

   3. Contractor shall not subject any data subject to fully automated individual decision-making or profiling that produces legal or similarly significant effects.

   4. Any third-party infrastructure provider, enterprise API, or external software Contractor providing AI capabilities utilized by the Contractor must be formally approved as a Subprocessor. The Contractor warrants that it has executed a written agreement with such AI Subprocessors imposing data protection obligations no less restrictive than those set forth in this DPA, explicitly including the absolute prohibition on model training and strict compliance with lawful cross-border data transfer mechanisms.

   5. All AI tools deployed by the Contractor must inherently comply with the principles of data protection by design and default, utilizing data minimization and state-of-the-art security controls. Upon request, the Contractor shall provide the Customer with documented, meaningful information regarding the underlying logic and parameters of any algorithmic segmentation used, ensuring the Customer can fulfill applicable regulatory transparency obligations.

   6. AI tools used by Contractor for the delivery of the Service are listed in Exhibit B, including details about:

      1. Name of AI tool

      2. Purpose of use

      3. Use of Customer data

      4. Terms of use

      5. Subject to Internal acceptable use policy

9. Data Transfers.

   1. Contractor may not engage in any cross-border Processing of Personal Data, or transmit (directly or indirectly) any Personal Data to any country outside of the country from which such Personal Data was provided to Contractor, unless it complies with Data Protection Laws. To the extent required by Data Protection Laws, Contractor shall ensure that a lawful data transfer mechanism is in place prior to engaging in any onward transfers of Personal Data from one country to another.

   2. To the extent legally required, by entering into this DPA, Customer and Contractor are deemed to have signed the EU SCCs, which form part of this DPA and will apply to any transfers from the European Economic Area (EEA) to countries outside the EEA that are not covered by other legal mechanisms for the transfer of Personal Data. Except as described in Sections 7(c) and (d) below, such EU SCCs are deemed completed as follows:

      1. Module 2 of the EU SCCs applies to transfers of Personal Data from Customer (as a Controller) to Contractor (as a Processor), and Module 3 of the EU SCCs applies to transfers of Personal Data from Customer (as a Processor) to Contractor (as a Subprocessor);

      2. Clause 7 (the optional docking clause) is not included;

      3. Clause 9 (Use of sub-processors): The Parties select Option 2 (General written authorization). The initial list of Subprocessors is set forth in Exhibit B of this DPA and Contractor shall propose updates to that list in accordance with Section 6(b) of this DPA;

      4. Clause 11 (Redress): The optional language requiring that data subjects be permitted to lodge a complaint with an independent dispute resolution body is not included;

      5. Clause 17 (Governing law): The Parties choose Option 1 (the law of an EU Member State that allows for third-Party beneficiary rights) and select the law of the Ireland;

      6. Clause 18 (Choice of forum and jurisdiction): The Parties select the courts of the Ireland;

      7. Annexes I (List of Parties) and II (Technical and organizational measures) are completed as set forth in Exhibit A and Information Security Addendum, respectively; and

      8. Annex III (List of subprocessors) is not applicable because the Parties have chosen General Authorization under Clause 9.

   3. To the extent legally required, by entering into this DPA, the Parties are deemed to be signing the UK Addendum, which forms part of this DPA and takes precedence over the rest of this DPA as set forth in the UK Addendum. The Tables within the UK Addendum are deemed completed as follows:

      1. Table 1: The Parties’ details shall be the Parties and their affiliates to the extent any of them is involved in such transfer, and the Key Contact shall be the contacts set forth in Exhibit A below.

      2. Table 2: The Approved EU SCCs referenced in Table 2 shall be the EU SCCs as executed by the Parties and completed in Section 7(b) of this DPA.

      3. Table 3: Annexes I and II are set forth in Exhibits A and Information Security Addendum of this DPA, respectively. Annex III is inapplicable.

      4. Table 4: Customer may end this DPA as set out in Section 19 of the UK Addendum.

10. Additional Safeguards. To the extent that Contractor Processes Personal Data of Data Subjects located subject to the applicable Data Protection Laws in the EEA, UK, or Switzerland, Contractor agrees to the following safeguards (“Additional Safeguards”) to protect such data to an equivalent level as applicable Data Protection Laws:

    1. As of the date of this DPA, Contractor has not received any national security orders of the type described in Paragraphs 150-202 of the judgment in the EU Court of Justice Case C-311/18, Data Protection Commissioner v Facebook Ireland Limited and Maximillian Schrems.

    2. As of the date of this DPA, no court has found Contractor to be the type of entity eligible to receive process issued under FISA Section 702: (i) an “electronic communication service provider” within the meaning of 50 U.S.C § 1881(b)(4) or (ii) a member of any of the categories of entities described within that definition.

    3. To the extent permitted by applicable law, Contractor will promptly, and in any event within three (3) days, notify Customer of any request by any government or law enforcement entity regarding Personal Data that Contractor Processes on Customer’s behalf; await written instructions from Customer on how, if at all, to assist in responding; and render Customer reasonable assistance and cooperation in relation to any such request.

    4. Contractor will notify Customer if Contractor can no longer comply with the EU SCCs or UK Addendum (as applicable) or these Additional Safeguards, without being required to identify the specific provision with which it can no longer comply. 

11. Additional limitations on processing in certain countries

    1. Contractor will not process Customer data in a country other than United States of America, members of the European Union, Canada, United Kingdom, Australia, unless explicitly authorized in writing by Customer.

12. Audits. Contractor will make available to Customer all information necessary to demonstrate compliance with this DPA and will allow for and contribute to audits, including inspections, conducted by Customer or another auditor mandated by Customer, provided that, except in the case of a Security Breach, for which there is no frequency limitation, such audit shall occur not more than once every twelve (12) calendar months, upon reasonable prior written notice, and to the extent Contractor’s personnel are required to cooperate therewith, during Contractor’s normal business hours. Contractor will, at its own cost, remediate any noncompliance with this DPA or Data Protection Laws identified during an audit.

13. Return or Destruction of Personal Data. Except to the extent required otherwise by Data Protection Laws, Contractor will, at the choice of Customer, return to Customer and/or securely destroy all Personal Data upon (a) written request of Customer or (b) termination of the Agreement. Except to the extent prohibited by Data Protection Laws, Contractor will inform Customer if it is not able to return or delete Personal Data.

14. US Privacy Laws. To the extent processing of Personal Data under the Agreement is subject to U.S. Privacy Laws:

    1. The Parties acknowledge that Contractor's retention, use and disclosure of Customer Personal Data authorized by the Customer's instructions stated in this Agreement are integral to the Contractor Services and the business relationship between the Parties.

    2. Contractor shall:

       1. Use, retain, and disclose Customer Personal Data only as necessary to perform the business purposes specified in this Agreement or as otherwise permitted by U.S. Privacy Laws;

       2. Comply with applicable obligations under U.S. Privacy Laws and shall provide the same level of privacy protection as is required of a "service provider" or "contractor" under each applicable U.S. Privacy Law;

       3. Notify the Customer without undue delay if Contractor determines it cannot meet its obligations under U.S. Privacy Laws;

    3. Contractor shall not:

       1. Sell or share any Customer Personal Data

       2. Retain, use or disclose any Customer Personal Data for any purpose other than for the business purposes specified in the Agreement, including retaining, using, or disclosing the Customer Personal Data for a commercial purpose other than the business purposes specified in the Agreement or as otherwise permitted by U.S. Privacy Laws

       3. Combine the Customer Personal Data received from the Customer with Customer Personal Data received from or on behalf another person, or Customer Personal Data Contractor collects from its own interaction with the consumer.

15. Indemnification. To the extent permitted by Data Protection Laws, the provisions on indemnification in the Agreement apply to this DPA.

16. Survival. The provisions of this DPA survive the termination or expiration of the Agreement for so long as Contractor or its Subprocessors Process Personal Data.

SIGNED by the Parties or their duly authorized representatives:

Customer [Contractor Name]

Signed:  Signed:

Name:               Name:              

Title:         Title:

Date: Date:

Exhibit A

For cross border purposes - ANNEX I TO THE EU SCCS

1. LIST OF PARTIES

Data exporter(s):

• Name: Customer, as identified in the DPA.

• Address: As provided in the Agreement.

• Contact person’s name, position, and contact details: As provided in the Agreement.

• Activities relevant to the data transferred under these Clauses: The data exporter receives the data importer’s Services pursuant to their underlying Agreement.

• Signature and date: The Parties agree that execution of the DPA shall constitute execution of these EU SCCs by both parties.

• Role: Controller

Data importer(s):

• Name: Contractor, as identified in the DPA.

• Address: As provided in the Agreement.

• Contact person’s name, position, and contact details: As provided in the Agreement.

• Activities relevant to the data transferred under these Clauses: The data importer provides Services to the data exporter pursuant to their underlying Agreement and the attached statement of work.

• Signature and date: The Parties agree that execution of the DPA shall constitute execution of these EU SCCs by both parties.

• Role: Processor

B. DESCRIPTION OF Processing and TRANSFER

Categories of data subjects whose personal data is processed and transferred: The Personal Data transferred as described in the SOW

Types of personal data transferred – as described in the SOW.

Sensitive data transferred – as data transferred is sensitive because of its affiliation to religion Contractor will restrict access identifiable data only to the minimal staff necessary, will keep a record of access to the data, and will refrain from onward transfers.

The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis): continuous

Nature of the processing: Contractor’s Processing activities shall be limited to those set out in the Agreement and as required by the Statement of Work and the DPA.

Purpose(s) of the data processing transfer and further processing: The purpose of the transfer to and further Processing of Personal Data by Contractor is for Contractor to provide the Services to Customer as set forth in the Agreement, the Statement of Work and the DPA.

The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period: Personal Data will be retained for the period of time necessary for Contractor to provide the Services to Customer under the Agreement and/or in accordance with applicable legal requirements.

For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing: Same as above to the extent that Personal Data is provided to Subprocessors for purposes of providing the Services.

C. COMPETENT SUPERVISORY AUTHORITY

To the extent legally permitted, the competent supervisory authority is the Israeli Privacy Authority.

Exhibit B

CONTRACTOR SUBPROCESSORS

AI tools

3. Information Security Addendum

Security Declaration

Constituting an integral part of the contractual agreement
dated _______ (henceforth: the "Agreement")

Between

Taglit BRI - Global Birthright Israel (a public benefit corporation)

(henceforth: "Taglit BRI")

and

_______________________________ Ltd.

(henceforth: the "Supplier")

Access to the BRI’s Data and the Purpose of the Service

The Supplier will processs and collect Taglit BRI data and for the purposes defined in the Data Protection Agreement (DPA)

This Addendum specifies the information security measures required from Contractor for the supply of the services.

1. Sub-Contractors

As of the date this Appendix was signed, the Supplier is entitled to execute the Services using the following types of Sub-Contractors: _______________________, subject to compliance with the provisions of this document.

1. The Supplier undertakes to maintain the security provision set forth in the section entitled "Data Security Requirements for Suppliers".

2. If the Supplier uses cloud services stored outside the borders of the State of Israel, the Supplier must secure Taglit BRI's approval for the use of the said service and ensure that its cloud storage provider guarantees an adequate level of data protection, as specified in the section entitled "Data Security Requirements for Suppliers" – Cloud Computing and Security Management in Cloud Services.

2. Personnel, Access Control and Confidentiality

   1. The Contractor commits to maintaining controls which ensure that employees working with Customer Personal Data are appropriate, after reasonable measures are taken, as is common practice in employee screening procedures. It will also conduct training sessions regarding Privacy Protection Law and the Regulations for those employees, before they are provided access to Customer Personal Data, or before the scope of their permission is modified. Furthermore, the Contractor undertakes to conduct periodic training, at least once per annum for those with permission.

   2. The Contractor will ensure that no person acting on its behalf shall disclose Data the Contractor or anyone acting on its behalf has received on account of its position as an employee, manager, manager of a database, or other service provider pertaining to the Processing of Customer Personal Data, unless it is required for the Purpose of the Service, and that it is aware of the provisions of Section 16 of the Privacy Protection Law, and Regulation 19 of the Privacy Protection Regulations.

   3. The Contractor undertakes that the Contractor and/or its employees shall have permission to access Customer Data solely for the Purpose of the Service, and not for any other purpose, each employee on the basis of their responsibilities. The Contractor shall prepare a list of authorized roles and keep it in its possession.

   4. The Contactor undertakes that the Contractor and its employees, as well as sub-contractors and those with roles (as defined in the Regulations) acting on its behalf, shall sign a document undertaking to preserve confidentiality, which applies, inter alia, to Customer Personal Data. This undertaking includes upholding provisions applicable to the permitted scope of the use of the Data, as well as provisions applicable to the implementation of security procedures for Customer and the Contractor.

3. The Method for Fulfilling the Contractor Data Security Obligations

Data Security:

1. Throughout the contractual period, and as long as the Supplier processes Customer Personal Data, the Contractor undertakes to maintain data security mechanisms that meet the accepted market standards, at the relevant time, which shall be no less stringent than the provisions of the Data Protection Laws, as they are in effect from time to time.

2. Contractor undertakes to comply with such information security standards. Contractor may adopt the SANS Institute CIS V8 security controls. For more information: https://www.sans.org/blog/cis-controls-v8/which contains the following controls:

• Inventory and control for enterprise assets

• Inventory and control of software assets

• Data protection

• Secure configuration of enterprise assets and software

• Account management

• Access control management

• Continuous vulnerability management

• Audit and log management

• Email and web browser protection

• Malware defenses

• Data recovery

• Network infrastructure management

• Network monitoring and defense

• Security awareness and skills training

• Service provider management

• Application software security

• Incident response management

• Penetration testing

3. Data Security Requirements for Suppliers:

   1. Compliance with Data Security standards – The Contractor collecting data on behalf of Customer undertakes to comply with accepted data security standards, such as ISO27001:2013, NIST-800 and the like. Alternatively, it undertakes to comply with Customer additional data procedures, beyond those specified in this document, which will be provided as necessary.

   2. In addition :

      1. Preservation of security data – The Contractor undertakes to retain security related audit data for 24 months. The following data items must be saved: Role/permission modifications and inventory, identification of those accesing the database and verification of their permissions, cancelation of permissions for those who are no longer employed by the Contractor , hacking attempts, remote connections, encryption methods for transferring data over the internet, third-party agreements and changes to them, periodic security audits.

      2. Cloud computing – In addition to the above, if, during the period of the contractual relationship, a cloud-based computing service is provided to Customer (i.e., either the Contractor uses cloud computing services, or the Contractor itself is a cloud computing service provider), , Data owned by Customer which is stored via cloud computing services shall be stored using a secure and controlled system, including the use of logical security controls, encryption controls, and limited and limited access from the Contractor's network; communications for managing the cloud environment shall take place over an encrypted medium only; access permissions will only be given to users with essential roles, on a "need to have" basis only, and the Contractor will need to implement strong authentication controls, documentation and controls. Moreover, the Contractor is required to notify and receive approval from Customer regarding the use of cloud infrastructure not located in Israel.

      3. Cloud services security management - If the Contractor itself is a cloud computing service provider, even if it is provided partially, the Contractor undertakes to specify its program for managing cloud service security. The Contractor to secure approval for the cloud usage configuration, including compartmentalization of logical infrastructure (such as log servers, databases, and other services) from the services of other clients using the cloud service. Moreover, it must provide details on the architecture of the network supporting the service. The Contractor must provide details on the frequency of robustness testing and data security surveys, run independently and by a third-party expert on the communication layers, the operating system, and the cloud service application. The Contractor undertakes to notify Customer of any anticipated material change in cloud computing, in the cloud computing infrastructure, and/or in the cloud computing suppliers, including the closure and/or cancelation of the service.

3. Separation of Databases

The Contractor affirms that the Data that it will receive in the context of the contractual relationship shall be kept separate from the other databases in its possession.

4. Annual Report and Periodic Audits:

The Contractor will conduct ethical hacking tests, and in addition, at least once a year, perform a risk assessment.

Customer reserves the right to require the report with the results of the assessments, and furthermore to perform the audits itself.

In addition, the Supplier will submit to Taglit the remediation plan and the remediation progress.

5. General Provisions:

The Contractor shall establish a contact person acting in its behalf, who shall maintain contact with a representative of Supplier. The contact persons shall coordinate between them anything that needs to be investigated with relation to data security and the permitted use of the Data.

I hereby declare that I am authorized to bind the Contractor _______ through my signature.

In witness thereof, I have signed this document on the _____ (day) of ______ (month), _______ 2023.

Signatory Details:

Name: ______________________ ID No.: ____________________ Role: __________________

Signature: _______________