Bettermode Data Processing Addendum

I. Definitions

(A) “Applicable Law” means all applicable laws and regulations relating to the privacy, confidentiality, security and protection of Personal Data, including, without limitation: the Personal Information Protection and Electronic Documents Act (“PIPEDA”);the UK Data Protection Act 2018 the GDPR as it forms part of United Kingdom law by virtue of section 3 of the United Kingdom’s European Union (Withdrawal) Act 2018, and as amended by the Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019 (SI 2019/419) (the “UK GDPR”); the Swiss Federal Act on Data Protection;; the European Union (“EU”) General Data Protection Regulation 2016/679 (“GDPR”) as applied, supplemented, modified and/or replaced from time to time by the laws of the United Kingdom, Switzerland and/or the relevant member state of the European Union and European Economic Area (as the case may be);,; EU Directive 2002/58/EC on Privacy and Electronic Communications; the California Consumer Privacy Act of 2018 and any regulations promulgated thereunder, as amended from time to time (the “CCPA”); and any other directly applicable laws or regulation relating to privacy and data rights of natural persons having effect or enacted in the United States, Switzerland, United Kingdom, the European Economic Area, and/or the European Union or a relevant state or member state thereof (as the case may be), or anywhere else in the world, in each of the foregoing instances, as applicable to the Processing of Personal Data by the Data Processor.

(B) “Data Controller” means a person who alone or jointly with others determines the purposes and means of the Processing of Personal Data.

(C) “Data Processor” means a person who Processes Personal Data on behalf of the Data Controller.

(D) “Data Subject” means an identified or identifiable natural person to which the Personal Data pertain.

(E) “Instructions” means this Addendum and any further written agreement or documentation through which the Data Controller instructs the Data Processor to perform specific Processing of Personal Data.

(F) “Personal Data” and “Personal Information” means any information relating to: (i) an identified or identifiable natural person; or (ii) an identified or identifiable legal entity (where such information is protected similarly as personal data or personally identifiable information under Applicable Law), where for each (i) or (ii), such data, or any part of such data, is Processed in the performance of Services. in particular by reference to an identifier such as name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

(G) “Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data transmitted, stored or otherwise Processed.

(H) “Process”, “Processed”, or “Processing” means any operation or set of operations performed upon Personal Data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

(I) “Services” means the services offered by Bettermode and subscribed for by Customer under the Master Agreement.

(J) “Sub-Processor” means the entity engaged by the Data Processor or any further Sub-Processor to Process Personal Data on behalf and under the authority of the Data Controller.

(K) “Standard Contractual Clauses” or “SCCs” means (i) where the GDPR applies, the contractual clauses annexed to the European Commission’s Implementing Decision 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation EU 2016/679 of the European Parliament and of the Council (“EU SCCs”); and (ii) where the UK GDPR applies, the "International Data Transfer Addendum to the EU Commission Standard Contractual Clauses" issued by the Information Commissioner's Office under Section 119A(1) of the UK Data Protection Act 2018 (the “UK Addendum").

II. Roles and Responsibilities of the Parties

(A) This Addendum applies only to the extent that Bettermode Processes Personal Data on behalf of Customer in providing the Services and where such Personal Data is subject to the Applicable Laws.

(B) The Parties acknowledge and agree that Customer is acting as a Data Controller,and has the sole and exclusive authority to determine the purposes and means of the Processing of Personal Data Processed under this Addendum, and Bettermode is acting as a Data Processor on behalf and under the Instructions of Customer.

(C) Any Personal Data will at all times be and remain the sole property of Customer and Bettermode will not have or obtain any rights therein.

III. Obligations of Bettermode

Bettermode agrees and warrants to:

(A) Process Personal Data disclosed to it by Customer only on behalf of and in accordance with the Instructions of the Data Controller and Annex 1 of this Addendum, unless Bettermode is otherwise required by Applicable Law. Bettermode shall inform Customer if, in Bettermode’s opinion, an Instruction provided infringes Applicable Law.

(B) Ensure that any person authorised by Bettermode to Process Personal Data in the context of the Services is only granted access to Personal Data on a need-to-know basis, is subject to a duly enforceable contractual or statutory confidentiality obligation, and only Processes Personal Data in accordance with the Instructions of the Data Controller.

(C) Inform Customer promptly and without undue delay of any formal requests from Data Subjects exercising their rights of access, correction or erasure of their Personal Data, their right to restrict or to object to the Processing as well as their right to data portability, and not respond to such requests, unless instructed by the Customer in writing to do so. Taking into account the nature of the Processing of Personal Data, Bettermode shall assist Customer, by appropriate technical and organisational measures and at Customer’s cost, insofar as possible, in fulfilling Customer’s obligations to respond to a Data Subject’s request to exercise their rights with respect to their Personal Data.

(D) Notify Customer promptly and without undue in writing of any subpoena or other judicial or administrative order by a government authority or proceeding seeking access to or disclosure of Personal Data. Customer shall have the right to defend such action in lieu of and on behalf of Bettermode. Customer may, if it so chooses, seek a protective order. Bettermode shall reasonably cooperate with Customer in such defense.

(E) Provide reasonable assistance to Customer, at Customer’s cost, in complying with Customer’s obligations under Applicable Law.

(F) Maintain internal record(s) of Processing activities, and shall on request provide Customer with the information set out in Annex 1 or a summary of those records, and shall provide full copies to supervisory authorities upon request.

(G) Remain in compliance with GDPR, CCPA, PIPEDA and all other Applicable Laws with respect to any and all of Customer’s users while they are using the Services.

IV. Data storage and transfers

(A) Bettermode hosts the primary database, files and backups for each of Customer’s communities (together, “Primary Data Storage”) in the hosting region selected in the applicable Order Form or, where there is no Order Form, selected by Customer when setting up its account (the “Hosting Region”). The Hosting Region determines the location of Primary Data Storage only. Bettermode and its Sub-Processors may access, transfer and otherwise Process Personal Data outside the Hosting Region, including for support, security, maintenance and the provision of functionality that relies on Sub-Processors. Each Sub-Processor, and the location(s) in which it Processes Personal Data, is listed at https://bettermode.com/subprocessors. Nothing in an Order Form, the Documentation or any other communication from Bettermode is a commitment that Personal Data will be stored, accessed or otherwise Processed only within the Hosting Region, unless the Order Form expressly states that it amends this Section IV(A). Bettermode has and shall continue to enter into any written agreements as are reasonably necessary (in its reasonable determination) to comply with Applicable Law concerning any cross-border transfer of Personal Data, whether to or from Bettermode.

(B) Where required in order to comply with Applicable Laws, including (a) the GDPR, the EU SCCs, completed as set out in Annex 2, and the additional terms set forth in this Section shall apply only to Personal Data that is transferred from the EEA to outside the EEA, either directly or via onward transfer, to any country or recipient: (i) not recognized by the European Commission as providing an adequate level of protection for personal data, and (ii) not covered by a suitable framework recognized by the relevant authorities or courts as providing an adequate level of protection for personal data, including but not limited to Binding Corporate Rules for Processors; and (b) the UK GDPR, the UK Addendum and the additional terms set forth in this Section shall apply only to Personal Data that is transferred from the UK to outside the UK, either directly or via onward transfer, to any country or recipient which is not subject based on adequacy regulations pursuant to Section 17A of the United Kingdom Data Protection Act 2018.

(C) The Standard Contractual Clauses and the additional terms specified in this Section apply to the legal entity that has entered into the Standard Contractual Clauses, including by accepting this Addendum, as a data exporter and those of its Affiliates that are subject to the Applicable Laws if and to the extent Bettermode Processes Personal Data for which such legal entity and its Affiliate(s) qualify as the Data Controller. For purposes of the Standard Contractual Clauses, the aforementioned entities shall be deemed “data exporters”;

(D) Pursuant to Clause 9(a) of the EU SCCs, Customer agrees that Bettermode may engage Sub-Processors in connection with the provision of the Services in accordance with Section V below;

(E) Customer agrees that the copies of the Sub-Processor agreements to be provided by Bettermode to Customer pursuant to Clause 9(c) of the EU SCCs (where applicable) may have all commercial information, or clauses unrelated to the EU SCCs or their equivalent, removed by Bettermode, and such copies will be provided by Bettermode only upon written request by Customer and subject to any obligations of confidentiality to which Bettermode may be bound, and further provided, if Bettermode is contractually restricted from disclosing any such agreements to Customer, Bettermode will use reasonable efforts to require such Sub-Processor to permit it to disclose the agreement to Customer; Customer agrees that the certification of deletion of Personal Data that is described in Clauses 8.5 and 16(d) of the EU SCCs shall be provided by Bettermode to Customer only if requested by the Customer in writing.

(F) In relation to Personal Data that is protected by the UK GDPR, the Parties agree as follows (a) the EU SCCs, completed as set out in Annex 2 shall apply, and the EU SCCs will be deemed amended as specified by Part 2 of the UK Addendum, which will be deemed entered into and incorporated into this Addendum by this reference; (b) Tables 1 to 3 in Part 1 of the UK Addendum shall be deemed completed with the relevant information from the EU SCCs, completed as set out in Annex 1 of this Addendum (as applicable); and (c) the option "Exporter" shall be deemed checked in Table 4 in Part 1 of the UK Addendum

V. Sub-Processing

(A) Bettermode shall not share, transfer, disclose, make available or otherwise provide access to any Personal Data to any third party, or contract any of its rights or obligations concerning Personal Data, unless Bettermode has entered into a written agreement with each such third party that imposes obligations on the third party that are substantively similar as those imposed on Bettermode under this Addendum. Bettermode shall only retain third parties that are capable of appropriately protecting the privacy, confidentiality and security of the Personal Data. A list of Bettermode’s current Sub-Processors are set out at https://bettermode.com/subprocessors. Bettermode shall give notice of any new Sub-Processor by updating that list at least thirty (30) days before the new Sub-Processor begins Processing Personal Data and by sending an email to the email address associated with Customer’s account. Notice is effective on the date the list is updated. If Customer objects on reasonable data protection grounds and Bettermode is unable to make an alternative arrangement within a reasonable period, Customer’s sole remedy is to terminate the affected Services.

(B) Where Customer permits the integration of the Service with third party services, such integration may allow for the transfer of data to such third party (subject to Customer’s consent through the configuration of the integration by Customer). Such third parties shall not be considered Sub-Processors for the purpose of this section and it is Customer sole obligation to ensure that it has the appropriate agreements in place with such third party in respect of the Processing of such data.

VI. Compliance with Applicable Laws

(A) Each Party covenants and undertakes to the other that it shall comply with all Applicable Laws in the use of the Services.

(B) Without limiting the above, (i) Customer is responsible for ensuring that it has a lawful basis for the Processing of Personal Information in the manner contemplated by this Addendum, and has adequate record of such basis (whether directly or through another third party provider); and (ii) Bettermode is not responsible for determining the requirements of laws applicable to Customer’s business or that Bettermode’s provision of the Services meet the requirements of such laws. As between the Parties, Customer is responsible for the lawfulness of the Processing of the Personal Data. Customer will not use the Services in conjunction with Personal Data to the extent that doing so would violate Applicable Law.

(C) If a Data Subject brings a claim directly against Bettermode for a violation of their Data Subject rights in breach of Applicable Laws and such claim does not arise from a breach by Bettermode of the terms of this Addendum, Customer will indemnify Bettermode for any cost, charge, damages, expenses or loss arising from such a claim, to the extent that Bettermode has notified Customer about the claim and given Customer the opportunity to cooperate with Bettermode in the defense and settlement of the claim. Subject to the terms of the Master Agreement, Customer may claim from Bettermode amounts paid to a Data Subject for a violation of their rights caused by Bettermode’s breach of its obligations under Applicable Law, including the GDPR and UK GDPR.

VII. Data Security

(A) Bettermode shall develop, maintain and implement a comprehensive written information security program that complies with Applicable Law and good industry practice. Bettermode’s information security program shall include appropriate administrative, technical, physical, organisational and operational safeguards and other security measures designed to (i) ensure the security and confidentiality of Personal Data; (ii) protect against any anticipated threats or hazards to the security and integrity of Personal Data; and (iii) protect against any Personal Data Breach, including, as appropriate:

a) The encryption of the Personal Data;

b) The ability to ensure the ongoing confidentiality, integrity, availability and resilience of Processing systems and services;

c) The ability to restore the availability and access to the Personal Data in a timely manner in the event of a physical or technical incident; and

d) A process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures adopted pursuant to this provision for ensuring the security of the Processing.

(B) Bettermode shall supervise Bettermode personnel to the extent required to maintain appropriate privacy, confidentiality and security of Personal Data. Bettermode shall provide training, as appropriate, to all Bettermode personnel who have access to Personal Data.

(C) Promptly (and in any event within 90 days) following the expiration or earlier termination of the Master Agreement, Bettermode shall return to Customer or its designee, if so requested during such period, or if not so requested securely destroy or render unreadable or undecipherable, each and every original and copy in every media of all Personal Data in Bettermode’s, its affiliates’ or their respective subcontractors’ possession, custody or control, excluding copies retained in routine backups and archives, which are deleted in accordance with Bettermode’s normal backup cycle, and anything Bettermode is required by Applicable Law to retain. In the event applicable law does not permit Bettermode to comply with the delivery or destruction of the Personal Data, Bettermode warrants that it shall ensure the security and confidentiality of the Personal Data and that it shall not use or disclose any Personal Data after termination of this Addendum.

VIII. Data Breach Notification

(A) Bettermode shall promptly and without undue delay inform Customer in writing of any Personal Data Breach of which Bettermode becomes aware. The notification to Customer shall include all available information regarding such Personal Data Breach, including information on:

a) The nature of the Personal Data Breach including where possible, the categories and approximate number of affected Data Subjects and the categories and approximate number of affected Personal Data records;

b) The likely consequences of the Personal Data Breach; and

c) The measures taken or proposed to be taken to address the Personal Data Breach, including, where appropriate, measures to mitigate its possible adverse effects.

(B) Bettermode shall cooperate fully with Customer in all reasonable and lawful efforts to prevent, mitigate or rectify such Personal Data Breach, to notify affected Data Subjects if required by Applicable Law, and to take all other actions required under Applicable Law as a result of the Personal Data Breach. Bettermode shall provide such assistance as required to enable Customer to satisfy Customer’s obligation to notify the relevant supervisory authority and Data Subjects of a Personal Data Breach under Articles 33 and 34 of the GDPR or other Applicable Laws, if applicable.

IX. Audit

Bettermode shall, on written request and not more than once per year other than in the event of a Personal Data Breach, make available to Customer the information necessary to demonstrate compliance with the obligations set forth in this Addendum, which may take the form of Bettermode’s published security documentation or a completed standard security questionnaire, together with, where Bettermode holds one, a copy of Bettermode’s then-current third-party security audit report.

Customer agrees that the information made available under the preceding paragraph will be used in the first instance to satisfy any audit or inspection request, including under Clause 8.9 of the EU SCCs. If that information is not sufficient to demonstrate Bettermode’s compliance with this Addendum, or where an audit is required by a supervisory authority or by Applicable Law, Bettermode shall allow for and contribute to an audit, including an inspection, conducted by Customer or by an independent auditor mandated by Customer, provided that: (i) Customer gives at least thirty (30) days’ written notice and the proposed scope, which the Parties will agree in good faith; (ii) no more than one audit is carried out in any twelve (12) month period, except following a Personal Data Breach or where required by a supervisory authority; (iii) the audit is conducted during normal business hours, in a manner that minimises disruption to Bettermode’s operations and, where reasonably possible, remotely; (iv) the auditor is not a competitor of Bettermode and is bound by written confidentiality obligations no less protective than those in the Master Agreement; (v) the audit does not extend to the data of Bettermode’s other customers or to the systems or premises of Sub-Processors, in respect of which Bettermode may instead provide the Sub-Processor’s own audit reports; and (vi) Customer bears its own costs and reimburses Bettermode’s reasonable costs of assistance, which Bettermode will estimate in advance.

X. Governing Law

This Addendum shall be governed by the laws of the jurisdiction specified in the Master Agreement.

ANNEX 1: SCOPE OF THE DATA PROCESSING

This Annex forms part of the Data Processing Addendum between Customer and Bettermode.

The Processing of Personal Data concerns the following categories of Data Subjects: End users and Customer’s administrative users

The Processing concerns the following categories of Personal Data:

(i) Name: To help Data Subjects identify themselves in the community and let others call them by their names or nicknames

(ii) External user ID (Optional): To uniquely identify the Data Subject when the Data Subject is authenticated

(iii) Email address: To send email notifications to Data Subjects

(iv) Biography: For Data Subjects to introduce themselves to the community

(v) Profile Pictures: For Data Subjects to introduce themselves to the community by uploading their picture or Avatar

(vi) IP addresses: To log Data Subjects activities for future reference and to secure the community in case of spam attacks from a certain IP

(vii) Cookie data: sessionId for authentication purpose and CSRF-Token for security purpose

(viii) Behavioral Events: To enhance user experience and show the most relevant and recommended content to the Data Subjects

(ix) Posts, replies, uploaded files and videos of Data Subjects: To provide the community services to Data Subjects.

(x) such additional ad hoc categories as may be prompted by new fields added by Customer.

The Processing concerns the following categories of Sensitive Data:

None.

The Processing concerns the following categories of data Processing activities (i.e., purposes of Processing):

Provision of services to Customer and Customer’s end users

ANNEX 2

STANDARD CONTRACTUAL CLAUSES (Modules 2 and 3)

Where the transfer of Personal Data to Bettermode is a transfer described in Section IV(B) and Applicable Law requires that appropriate safeguards are put in place, such transfer shall be governed by the Standard Contractual Clauses, which shall be deemed incorporated into and form part of this Addendum as follows:

A. In relation to transfers of Personal Data protected by the GDPR, the SCCs shall apply as follows:

I. Module Two terms shall apply (where Customer is the controller of Personal Data) and the Module Three terms shall apply (where Customer is the processor of Personal Data);

II. in Clause 7, the optional docking clause shall apply and Customer’s Affiliates may accede the SCCs under the same terms and conditions as Customer, subject to mutual agreement of the Parties;

III. in Clause 9, option 2 (“general authorization”) is selected, and the process and time period for prior notice of Sub-Processor changes shall be as set out in Section V(A) of this Addendum;

IV. in Clause 11, the optional language shall not apply;

V. in Clause 17, option 1 shall apply and the SCCs shall be governed by Irish law;

VI. in Clause 18(b), disputes shall be resolved before the courts of Ireland;

VII. Annex I shall be deemed completed with the information set out in Annex 1 to this Addendum; and

VIII. Annex II shall be deemed completed with the information set out in the attached Annex II and Section VII (Data Security) of this Addendum.

B. In relation to transfers of Personal Data protected by the UK GDPR, the SCCs as implemented under Section A above shall apply with the following modifications:

I. the SCCs shall be modified and interpreted in accordance with Part 2 of the UK Addendum, which shall be deemed incorporated into and form an integral part of this Addendum;

II. Tables 1, 2 and 3 in Part 1 of the UK Addendum shall be deemed completed with the information set out in Annex 1, Annex 2 and Annex II to this Addendum, and Table 4 in Part 1 of the UK Addendum shall be deemed completed by selecting "neither party"; and

III. any conflict between the terms of the SCCs and the UK Addendum will be resolved in accordance with Section 10 and Section 11 of the UK Addendum.

C. In relation to transfers of Personal Data protected by the Swiss Federal Act on Data Protection, the SCCs as implemented under Section A above will apply with the following modifications:

I. references to “Regulation (EU) 2016/679” and specific articles therein shall be interpreted as references to the Swiss Federal Act on Data Protection and the equivalent articles or sections therein;

II. references to “EU”, “Union”, “Member State” and “Member State law” shall be replaced with references to “Switzerland” and/or “Swiss law” (as applicable);

III. references to the “competent supervisory authority” and “competent courts” shall be replaced with references to the “Swiss Federal Data Protection Information Commissioner” and “applicable courts of Switzerland”);

IV. the SCCs shall be governed by the laws of Switzerland ; and

V. disputes shall be resolved before the competent Swiss courts.

D. Where the Standard Contractual Clauses apply, this section sets out the Parties' interpretations of their respective obligations under specific provisions of the Clauses, as identified below. Where a Party complies with the interpretations set out below, that Party shall be deemed by the other Party to have complied with its commitments under the Standard Contractual Clauses:

I. where Customer is itself a processor of Personal Data acting on behalf of a third party controller and Bettermode would otherwise be required to interact directly with such third party controller (including notifying or obtaining authorizations from such third party controller), Bettermode may interact solely with Customer and Customer shall be responsible for forwarding any necessary notifications to and obtaining any necessary authorizations from such third party controller;

II. the certification of deletion described in Clause 16(d) of the SCCs shall be provided by Bettermode to Customer upon Customer's written request;

III. for the purposes of Clause 15(1)(a) the SCCs, Bettermode shall notify Customer and not the relevant Data Subject(s) in case of government access requests, and Customer shall be solely responsible for notifying the relevant Data Subjects as necessary; and

IV. taking into account the nature of the Processing, Customer agrees that it is unlikely that Bettermode would become aware of Personal Data Processed by Bettermode is inaccurate or outdated. To the extent Bettermode becomes aware of such inaccurate or outdated data, Bettermode will inform the Customer in accordance with Clause 8.4 SCCs.

ANNEX II - TECHNICAL AND ORGANISATIONAL MEASURES INCLUDING TECHNICAL AND ORGANISATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA

This Annex describes the technical and organisational measures implemented by Bettermode as Data Processor and completes Annex II to the Standard Contractual Clauses. Bettermode maintains a written information security program, approved by management and reviewed at least annually, that is appropriate to the nature, scope, context and purposes of the Processing and to the risks to Data Subjects. Further detail on these measures, and the certifications Bettermode holds from time to time, is published at https://trust.bettermode.com/. Bettermode may update these measures provided that no update materially reduces the overall level of security.

1. Governance and personnel. Bettermode maintains documented information security policies, assigns responsibility for information security to a designated individual or function, requires all personnel with access to Personal Data to be bound by confidentiality obligations and to complete security awareness training, and screens personnel before engagement to the extent permitted by Applicable Law.

2. Access control. Access to Personal Data is granted on a least-privilege and need-to-know basis, is individually attributable, requires multi-factor authentication for access to production systems, and is reviewed periodically and revoked promptly on change of role or termination of engagement.

3. Encryption. Personal Data is encrypted in transit over public networks and at rest using industry-standard algorithms, and cryptographic keys are managed separately from the data they protect.

4. Minimisation and pseudonymisation. Bettermode limits the Personal Data it Processes to that necessary to provide the Services, and applies pseudonymisation or aggregation where the purpose of the Processing can be achieved in that manner.

5. Confidentiality, integrity, availability and resilience. Bettermode maintains measures designed to ensure the ongoing confidentiality, integrity, availability and resilience of the systems used to Process Personal Data, including network segregation, hardened configurations and protection against malicious code.

6. Logging and monitoring. Bettermode logs access to, and material actions taken within, production systems, protects those logs against alteration, and monitors them for anomalous activity.

7. Vulnerability management. Bettermode performs vulnerability scanning, applies security patches on a risk-prioritised basis, and engages independent third parties to conduct penetration testing of the Services at least annually.

8. Secure development and change management. Changes to the Services follow a documented change management process including review and testing before deployment to production. Personal Data is not used in non-production environments except where equivalent controls apply.

9. Backup and recovery. Bettermode maintains backups of Personal Data, protects them to the same standard as production data, and tests its ability to restore availability and access to Personal Data in a timely manner in the event of a physical or technical incident.

10. Incident response. Bettermode maintains a documented incident response plan, investigates suspected security incidents, and notifies Customer of Personal Data Breaches in accordance with the Data Breach Notification section of this Addendum.

11. Physical security. The Services are hosted in third-party data centres that maintain physical and environmental controls appropriate to their function, evidenced by independent certification or audit. Bettermode does not host Personal Data on its own premises.

12. Sub-Processors and onward transfers. Bettermode conducts due diligence on each Sub-Processor before engagement, imposes data protection obligations on it no less protective than those in this Addendum, and reviews its performance periodically

13. Return, deletion and portability. Bettermode provides functionality enabling Customer to access, export, correct and delete Personal Data, and returns or deletes Personal Data in accordance with the Data Security section of this Addendum.

14. Business continuity. Bettermode maintains and periodically tests business continuity and disaster recovery arrangements for the Services.

View the previous version of this addendum (December 2022)