Opella Data Processing Addendum.

5.1. Transfers to Non-Adequate Countries. Transfers of Personal Data to Non-Adequate Countries are only permitted in the presence of a valid International Data Transfer Mechanism as required by applicable Data Protection Laws and as documented in sections 7 of the DPA Details. Where, according to applicable Data Protection Law, Data Subject consent is required for the Transfer of Personal Data, the Parties commit not to conduct the Transfer unless the appropriate consent has been obtained. The Parties must evaluate on a case-by-case basis, prior the Transfer, the necessity of additional security and/or contractual measures.

5.2. Transfer outside the EU/EEA. Where one or both Parties are located in Non-Adequate Countries and are Processing Personal Data subject to the GDPR, the EU SCC apply. The EU SCC, including Module 2 Controller-to-Processor ("Module 2") and Module 3 Processor-to-Processor ("Module 3") are incorporated by reference and are entered into by entering into this DPA. The Parties agree to amend the EU SCC as follows:

a. In the body of the EU SCC: (i) withdraw Clause 7 (Docking), (ii) withdraw Clause 11 (Redress), (iii) in clause 13.a (Supervision) and Appendix I.C, the Supervisory Authority where the data exporter is located, as per Section 7 of the DPA Details, is selected, (iv) in Clause 17 (Governing law), the law of the country where the data exporter is located, as per Section 7 of the DPA Details, is selected, and (v) in Clause 18 (Choice of forum and jurisdiction), the courts where the data exporter is located, according to Section 7 of the DPA Details, are selected.

b. In Annex I.A.:

C.

i. the data exporter's name, roles, address, country and activity relevant to the Personal Data transferred under the EU SCC are all listed in Section 7 of the DPA Details;

ii. the data exporter's contact person's name, position and contact details are indicated in Section 1 of the DPA Details;

ii. the data importer's name, roles, address, country and activity relevant to the Personal Data transferred under the EU SCC are all listed in Section 7 of the DPA Details;

iv. the data importer's contact person's name, position and contact details are indicated in Section 1 of the DPA Details;

The information required to complete the Annex I.B and Annex II. can be found in Sections 1, 7 and 10.1 of the DPA Details.

d. With regards to any Transfer listed in Section 7 of the DPA Details, the Personal Data is transferred on a continuous basis.

If the EU SCC were updated, and to the extent of the new EU SCC remaining consistent with the DPA, the new EU SCC shall replace the former version of the EU SCC in this DPA on the day their use become mandatory.

5.3. Transfer outside the UK. Where one or both Parties are located in Non-Adequate Countries and are Processing Personal Data subject to the United Kingdom ("UK") Data Protection Act 2018 ("UK GDPR"), the EU SCC, as well as Section 5.2 above apply and the UK International Data Transfer Addendum to the EU SCC, entered into force on 21 March 2022 (as amended or supplemented from time to time) ("UK Addendum"), is incorporated by reference and is entered into by entering into this DPA. The Parties agree to amend the UK Addendum as follows:

a. In the body of the approved EU SCC referenced in Section 5.2 above, to which the UK Addendum is appended to: (i) the Information Commissioner's Office is the competent Supervisory Authority as per Clause 13.a (Supervision) and Appendix I.C, (ii) the laws of the UK as per Clause 17 (Governing law) apply, (iii) the courts of the UK as per Clause 18 (Choice of forum and jurisdiction) are selected, (iv) references to the GDPR shall be replaced by the UK GDPR and references to specific Section(s) of the GDPR are replaced with the equivalent section(s) of the UK GDPR (if any), and (v) references to the Union, EU and EU Member State are all replaced with the UK.

b. The EU SCC's Annexes are completed as per Section 5.2 (b) to (d).

C. In Table 4 of the UK Addendum, "Both Parties may end the UK Addendum as set out in Section 19 of the UK Addendum" is added in the section "Ending this Addendum when the Approved Addendum changes".

d. The Alternative Part 2 Mandatory Clauses of the UK Addendum is selected.

5.4. Transfer outside Switzerland. Where one or both Parties are located in Non-Adequate Countries and are Processing Personal Data subject to the Swiss Federal Act on Data Protection from September 1st, 2023 ("FADP"), Section 5.2 above and the EU SCC apply, with the following amendments: (i) the Swiss Federal Data Protection and Information Commissioner is the competent Supervisory Authority as per Clause 13.a (Supervision) and Appendix I.C, (ii) the governing law shall be the Swiss law in case the Transfer is exclusively subject to the FADP, as per Clause 17 (Governing law), (iii) the term EU Member State must not be interpreted in such a way as to exclude Data Subjects in Switzerland from the possibility of suing for their rights in their place of habitual residence (Switzerland), and (iv) references to the GDPR shall also include the reference to the equivalent provisions of the FADP (as amended or replaced). The EU SCC's Annexes are completed as per Section 5.2 (b) to (d).

5.5. Alternative International Data Transfer Mechanisms for Transfers from the EU/EEA and/or the UK and/or Switzerland to the U.S. Where the Processors are located in the United States ("U.S.") and Personal Data subject to the GDPR and/or UK GDPR and/or FADP are transferred to the U.S, the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. Data Privacy Framework, and the Swiss-U.S. Data Privacy Framework (together "DPFs") apply, where relevant, when (i) the Processors have valid and current DPFs self-certifications and (ii) the DPFs are in force. In such case, the Processors warrants that they comply with the requirements of the applicable DPF. Should conditions (i) or (ii) no longer be met, the Processors shall promptly notify the Controllers and the EU SCC shall immediately and automatically govern such transfers in the place of the applicable DPF.

5.6. Transfer outside Turkey. When Personal Data is Transferred from Turkey the exporter undertakes that, with regard to such specific Transfer, it has obtained either (i) appropriate consent from relevant Data Subjects, according to applicable Data Protection Laws, or (ii) a permission from the competent Supervisory Authority based on an additional agreement with the importer(s).

5.7. Transfer outside South Korea. When Personal Data is Transferred from South Korea, the exporter undertakes that, with regard to such specific Transfer, it has informed the Data Subjects and obtained appropriate consent from them unless otherwise allowed by the law, according to Personal Information Protection Act 2011 (PIPA).

5.8. Transfer outside India. Transfer of Personal Data subject to the Indian Digital Personal Data Protection Act is not permitted to countries specifically blacklisted by the Government of India.

5.9. Transfer outside the People's Republic of China. The Processors shall not Transfer any Personal Data outside the People's Republic of China ("PRC") nor allow any third parties outside PRC to access Controllers' Personal Data without the written consent of the Controllers. Where the Controllers consent to the Transfer of Personal Data to and/or by the Processors, the latter shall collaborate and assist the Controllers, in accordance with the applicable PRC's laws and regulations, by (i) providing the required documentation to obtain the Transfer(s) approvals from the appropriate regulatory authorities and/or (ii) conducting security assessments and/or (iii) filing the applicable standard contractual clauses.

5.10. Transfer outside Brazil. Where one or both Parties are located in Non-Adequate Countries and are Processing Personal Data subject to the Data Protection Law applicable in Brazil, the Brazil SCC apply. The Brazil SCC are incorporated by reference and are entered into by entering into this DPA. The Parties agree to amend the Brazil SCC as follows:

a. in Clause 2 (Object),

i. the description of the international data transfer, the categories of personal data transferred and other information are those in Section 7 of the DPA Details,

ii. the Main purposes of the international data transfer is the provision of the service described is Section 1 of the DPA Details.

iii. the Data retention period is the duration of the Service as described in the Agreement.

b. under Clause 3.1, Option B is selected to allow for subsequent transfer, and the details concerning the transfer are the same included in Clause 2,

C. in Section III, the applicable security measures are those adopted by the importer pursuant to Section 3 of the DPA,

d. the exporters indicated in Section 1 of the DPA Details are responsible for the activities indicated at Clause 4.

If the Brazil SCC were updated, and to the extent of the new Brazil SCC remaining consistent with the DPA, the new Brazil SCC shall replace the former version of the Brazil SCC in this DPA on the day their use become mandatory.

5.11 Transfer outside ASEAN MEMBER STATES (SINGAPORE, MALAYSIA, INDONESIA, PHILIPPINES, THAILAND, VIETNAM) Where one or both Parties are located in Non-Adequate Countries and are Processing Personal Data subject to the laws appliable to one or more ASEAN Member staties, Module 1 of the ASEAN SCC apply. The Module 1 of the ASEAN SCC is incorporated by reference and is entered into by entering into this DPA. The Parties agree to amend the Module 1 of the ASEAN SCC as follows:

a. all the optional language does not apply,

b. Clause 3.10 is completed to indicate that the data exporter shall be notified without undue delay,

C. The descriptions required under Appendix A are those in Section 7 of the DPA Details.

If the ASEAN SCC were updated, and to the extent of the new ASEAN SCC remaining consistent with the DPA, the new ASEAN SCC shall replace the former version of the ASEAN SCC in this DPA on the day their use become mandatory.

5.12 Transfer outside ARGENTINA, COLOMBIA, ECUADOR, MEXICO, PANAMA AND PERU Where one or both Parties are located in Non-Adequate Countries and are Processing Personal Data subject to the laws appliable to Argentina, Colombia, Ecuador, Mexico, Panama or Peru, Module 2 of the IADPN SCC apply. The Module 2 of the IADPN SCC is incorporated by reference and is entered into by entering into this DPA. The Parties agree to amend the Module 2 IAPDN SCCs as follows:

a. The information identifying the parties are those in Section 1 and Section 7 of the DPA Details,

b. The information required under Annex B are those in Section 7 of the DPA, except for the Frequency of transfer which is agreed to be continuous, and the Term which is agreed to be the same of the Agreement,

C. Annex C references Section 3 of the DPA.

If the IADPN SCC were updated, and to the extent of the new IADPN SCC remaining consistent with the DPA, the new IADPN SCC shall replace the former version of the IADPN SCC in this DPA on the day their use become mandatory.

5.13 Transfer outside SAUDI ARABIA Where one or both Parties are located in Non-Adequate Countries and are Processing Personal Data subject to the laws appliable to Saudi Arabia, The Controller to Processor template (Second template) of the SDAIA SCCs apply. The Controller to Processor template (Second template) of the SDAIA SCC is incorporated by reference and is entered into by entering into this DPA. The Parties agree to amend the Controller to Processor template (Second template) of the SDAIA SCCs as follows:

a. The information required in Appendix 1 and Appendix 2 of the SDAIA SCC are those in Section 1 and Section 7 of the DPA Details.

b. The information required in Appendix 3 of of the SDAIA SCC are those in Section 3 of the DPA

If the SDAIA SCC were updated, and to the extent of the new SDAIA SCC remaining consistent with the DPA, the new SDAIA SCC shall replace the former version of the SDAIA SCC in this DPA on the day their use become mandatory.

5.14 Transfer outside the UNITED STATES OF AMERICA (U.S.). The Processors shall not Transfer any Bulk Sensitive Personal Data outside the U.S. to any entity or individual located in, or subject to the jurisdiction of, a Country of Concern, nor shall they permit any such entity or individual to access the Controllers' Bulk Sensitive Personal Data, without the prior written authorization of the Controllers. Where the Controllers provide such authorization, the Processors shall cooperate with and support the Controllers in accordance with applicable U.S. laws and regulations, including Executive Order 14117 and 28 C.F.R. Part 202, by (i) conducting and documenting appropriate due diligence and risk assessments, (ii) implementing technical and organizational safeguards to mitigate the risk of unauthorized access, and/or (iii) ensuring that any onward transfers are subject to contractual terms that reflect equivalent restrictions and obligations. For the purposes of the this clause:

a. "Bulk Sensitive Personal Data" refers to large-scale datasets containing information on U.S. persons that includes, but is not limited to, biometric identifiers, genetic data, health records, financial information, precise geolocation data, and personal identifiers that could be used to infer sensitive attributes or behaviors. The term also encompasses U.S. government-related data as defined by the U.S. Department of Justice.

b. "Countries of Concern" means any foreign nation designated by the U.S. Department of Justice as posing a national security risk under Executive Order 14117. As of the effective date of this Agreement, these include the People's Republic of China (including Hong Kong and Macau), Russia, Iran, North Korea, Cuba, and Venezuela.

5.15. Applicability of the EU SCC for other Data Protection Laws. The Parties undertake to adopt the EU SCC as an International Data Transfer Mechanism where, the applicable Data Protection Law: (i) expressly deems the EU SCC as valid International Data Transfer Mechanism, or (ii) requires the Parties to enter into a specific agreement to regulate the Transfer of Personal Data, where no dedicated template is available, and the EU SCC provide substantially similar but no less protective safeguards. In these cases, the Section 5.2 above applies, with the following amendments: (i) the Supervisory Authority in accordance with Clause 13 (Supervision) and Appendix I.C shall be the competent Supervisory Authority stated in the applicable Data Protection Laws, (ii) the governing law in accordance with Clause 17 (Governing law) shall be the law of the applicable country, (iii) the choice of forum and jurisdiction in accordance with Clause 18 (Choice of forum and jurisdiction) shall be the one applicable under the applicable country, (iv) references to the Union, EU and EU member state are all replaced with the reference to the applicable country, and (v) any references to the GDPR shall include the reference to the equivalent provisions of the applicable Data Protection Laws. The EU SCC Annexes are completed as per Section 5.2 (b) to (d).

5.16. Transfers to Sub-Processors. In case of Transfer of Personal Data from Processor to a Sub-Processor located in a Non-Adequate Country, the Processors warrant that, where and to the extent required by the applicable Data Protection Laws, valid International Data Transfer Mechanisms are implemented.