This Data Protection Addendum (“Addendum”) dated September 9, 2020 (“Addendum Effective Date”) forms part of the Terms of Use for the PetLab Co. Customer Portal (“Agreement”) between: (i) you (“Customer”); and (ii) PetLab Co. (“Company”).

WHEREAS, The PetLab Co. Customer Portal is a single point of access for Customer to manage all of their orders, subscriptions and personal information;

WHEREAS, Customer must sign up to edit subscriptions, view their orders, update their delivery details or create a pet profile;

WHEREAS, The information provided in the PetLab Co. Customer Portal may be used for product suggestions or to create a unique, customised experience for Customer when navigating Company websites.

NOWTHEREFORE, In consideration of the mutual obligations set out herein, the parties hereby agree that the terms and conditions set out below will be added as an Addendum to the Agreement.

1. Definitions

1.1 In this Addendum, the following terms will have the meanings set out below:

1.1.1 “Process/Processing”, “Controller”, “Processor” “Data Subject”, “Personal Data Breach” and “Special Categories of Personal Data” will have the same meaning as defined in EU Data Protection Laws;

1.1.2 “Affiliate” means an entity that owns or controls, is owned or controlled by or is or under common control or ownership with either Company Networks or Contract Partner (as the context allows), where control is defined as the possession, directly or indirectly, of the power to direct or cause the direction of the management and policies of an entity, whether through ownership of voting securities, by contract or otherwise;

1.1.3 “Company Networks Affiliate” means an Affiliate of Company Networks;

1.1.4 “EU Data Protection Laws” will mean Directive 95/46/EC (Data Protection) and Directive 2002/58/EC (ePrivacy), in each case as transposed into domestic legislation of each Member State of the European Economic Area (EEA) and in each case as amended, replaced or superseded from time to time, including without limitation by the EU General Data Protection Regulation 2016/679 of the European Parliament and of the Council (“GDPR”) and and any EEA Member State data protection laws substantially amending, replacing or superseding the GDPR;

1.1.5 “Data Subject Request” means a request from a Data Subject to exercise any right under EU Data Protection Laws;

1.1.6 “EEA” means the European Economic Area, and unless otherwise indicated, EEA or Member States of the EEA will continue to include the United Kingdom after it exits the European Union;

1.1.7 “EU Personal Data” means any Personal Data that is disclosed by one party or its Affiliate (“Discloser”) to the other party or its Affiliate (“Recipient”) in the performance of that party`‘`s rights or obligations under the Agreement, to the extent such Personal Data is related to residents of the EEA, or the disclosure of such Personal Data is otherwise subject to EU Data Protection Laws.

1.1.8 “Affiliate” means an Affiliate of Customer;

1.1.9 “Personal Data” means any personal data, as defined in EU Data Protection Laws;

1.1.10 “Restricted Transfer” means a transfer of EU Personal Data from Discloser to Recipient, to a jurisdiction outside of the EEA which is not deemed to have “adequate safeguards” as set forth under GDPR, Art. 45(1) (or any succeeding legislation of the United Kingdom upon its exit from the European Union.

1.1.11 “Standard Contractual Clauses” means (i) the standard contractual clauses for the transfer of personal data to controllers established in third countries which do not ensure an adequate level of protection as set out in Commission Decision C(2004)5721, as updated, amended, replaced or superseded from time to time by the European Commission, or (ii) any other contractual clauses or other mechanism approved by a Supervisory Authority or by Data Protection Laws for use in respect of such Restricted Transfer, as updated, amended, replaced or superseded from time to time by such Supervisory Authority or Data Protection Laws;

1.1.12 “Supervisory Authority” means (a) an independent public authority which is established by a Member State pursuant to Article 51 GDPR; and (b) any similar regulatory authority responsible for the enforcement of Data Protection Laws in the United Kingdom upon its exit from the European Union.

2. Controllers

2.1 The parties acknowledge that each will act as a separate Controller in relation to the Personal Data that they Process.

2.2 The parties will each comply with their respective obligations under EU Data Protection Laws in respect of their processing of Personal Data.

3. Disclosing of Personal Data

Where acting as a Discloser, each party will:

3.1 only disclose the Personal Data for one or more defined purposes that are consistent with the terms of the Agreement (“Permitted Purposes”);

3.2 ensure that (i) a notice has been made available and will continue to be accessible to the relevant Data Subject(s) informing them that their Personal Data will be disclosed to the Recipient or to a category of third party describing the Recipient; and (ii) obtained any necessary consents or authorisations required to permit the Recipient to freely Process the Personal Data for the Permitted Purposes;

3.3 not disclose any Special Categories of Personal Data to the Recipient; and

3.4 be responsible for the security of any Personal Data in transmission from the Discloser to the Recipient (or otherwise in the possession of the Discloser).

4. Processing of Personal Data

Where acting as a Recipient, each party will:

4.1 not Process Personal Data in a way that is incompatible with the Permitted Purposes (other than to comply with a requirement of applicable law to which Recipient is subject) or for a purpose that was not disclosed to the Data Subjects when the Personal Data was collected;

4.2 not Process Personal Data for longer than is necessary to carry out the Permitted Purposes (other than to comply with a requirement of applicable law to which Recipient is subject); and

4.3 taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of Processing, as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, have in place appropriate technical and organizational security measures to protect the Personal Data against unauthorized or unlawful Processing or accidental loss or destruction or damage.

5. Personal Data Breaches

5.1 The Recipient will notify the Discloser without undue delay following any Personal Data Breach involving the Personal Data.

5.2 Each party will co-operate with the other, to the extent reasonably requested, in relation to any notifications to Supervisory Authorities or to Data Subjects that are required following a Personal Data Breach involving the Personal Data.

6. Further Co-operation and Assistance

6.1 Each party will co-operate with the other, to the extent reasonably requested, in relation to: any requests from data subjects exercising their rights under European Data Protection Laws (“Data Subject Requests”),

6.1.1 any other communication from a Data Subject concerning the Processing of their Personal Data; and

6.1.2 any communication from a Supervisory Authority concerning the Processing of Personal Data, or compliance with EU Data Protection Laws.

7. Description of Personal Data

The parties acknowledge that the Customer will provide the following EU Personal Data to Company Networks: (a) categories of personal data: name, title, contact details, industry, and company details, which do not include any Special Categories of Data (sensitive data); (b) are related to the following types of data subjects: business contacts of former, current and prospective business customers, and (c) are disclosed and transferred for the purposes stated in the Agreement, including the distribution of Company Networks products and services, customer service issues related to Company Networks products and services, the marketing of Company Networks products and services, enhancing business contact information, facilitating joint-marketing efforts, and providing qualified leads to Company Networks.

8. Restricted Transfers

With respect to any Restricted Transfers to Customer, the parties hereby enter into the Standard Contractual Clauses, which are incorporated by reference into this Addendum as follows:

8.1 In some situations, Customer for itself and its relevant Affiliates is the “data exporter” and Company and its relevant affiliates are the date importers, and both parties have the authority to enter into the Standard Contractual Clauses for themselves and their respective relevant Affiliates.

8.2 For the purposes of clause II h) of the Standard Contractual Clauses, the Parties shall be deemed to have selected option (iii).

9. Governing Law and Jurisdiction

9.1 Without prejudice to clause IV of the Standard Contractual Clauses:

9.1.1 the parties to this Addendum hereby submit to the choice of jurisdiction stipulated in the Agreement with respect to any disputes or claims howsoever arising under this Addendum, including disputes regarding its existence, validity or termination or the consequences of its nullity; and

9.1.2 this Addendum and all non-contractual or other obligations arising out of or in connection with it are governed by the laws of the country or territory stipulated for this purpose in the Agreement.{" "}

IN WITNESS WHEREOF, this Addendum is entered into and becomes a binding part of the Agreement with effect from the Addendum Effective Date first set out above.

I hereby acknowledge that I have read, understand and agree to the terms of this agreement and I understand that clicking the this checkbox constitutes my acceptance of this agreement and that this action has the same legal effect of me signing this agreement.