Master Services Agreement Amendment No. 3 dated as of December 18, 2017 between The Endurance International Group, Inc. and Tregaron India Holdings, LLC

2.1 Service Provider agrees that it will comply with all applicable local, state, federal and foreign laws in providing the Services, including without limitation the Massachusetts Standards for the Protection of Personal Information of Residents of the Commonwealth (201 CMR 17.00) and EU Member State laws or regulations implementing the EU Data Protection Directive as amended.

2.2 Additionally, without limiting the foregoing, during the term of the Agreement and for so long as Service Provider retains EIG Confidential Information, Service Provider will obtain [**] independent attestation to the effectiveness of Service Provider’s product and corporate Privacy and Security Programs. It is mandatory for Service Provider to obtain compliance by [**] with the most current PCI-DSS standard for all in scope hardware, software, functions, and processes or similar used in providing the Services. Additionally, by [**], Service Provider must either undergo SSAE16 SOC 2 Type 2 audits with all trusted service principles or ISO27001 and ISO27018 certification for non-PCI activities or Services.

2.3 Service Provider will not store any EIG Confidential Information outside the United States without EIG’s prior written permission. Where permission is granted, EIG Confidential Information will be transferred using prevalent industry standard encryption and will comply with all applicable privacy data protection principles for so long such recipient retains such information. EIG Confidential Information stored in any locations will be stored at rest in an encrypted format, or with EIG permission, unencrypted with mitigating controls applied and demonstrated as effective.

3.1. The Parties acknowledge that the Services combined with Trusted Access involves a potential risk for abuse, including without limitation, credit card fraud and identity theft, and thus Service Provider shall have and maintain in place throughout the term of the Agreement adequate policies and procedures to reasonably prevent fraudulent abuse, enforcing them where appropriate and coordinating with EIG when necessary.

4.1 As between Service Provider and EIG, all EIG Confidential Information remains, at all times, the sole property of EIG. Service Provider will promptly comply with any commercially reasonable request from EIG requiring Service Provider to amend, transfer, return, or mask EIG Confidential Information, to the extent permitted by applicable law, and to the extent EIG does not have the reasonable ability to do so itself in its use of the Services. Service Provider will restrict access to EIG Confidential Information to those who need such access to perform their job duties.

4.2 Service Provider will take reasonable steps to ensure that disposal of removable media holding, or suspected of once holding, EIG Confidential Information, including without limitation, tapes, floppy discs, hard drives, or laptops or any other portable devices or media will be disposed of in such a way that EIG Confidential Information is not recoverable by any computer forensic means.

4.3 Service Provider will ensure that EIG Confidential Information on paper and other shreddable media including without limitation paper, microfiche, microfilm, CDs will be shredded using cross-cut shredding machines when no longer needed. This media may be shredded immediately or temporarily stored in a highly secured, locked container. The media may be shredded at a location other than the Service Provider's facilities; however it must be transferred in a highly secured locked container. Service Provider is responsible for supervising the shredding regardless of where the shredding activity occurs and by whom the shredding is performed. EIG Confidential Information on this media must be completely destroyed by shredding such that the results are not readable or useable for any purpose.

4.4 For avoidance of doubt, any deletion of EIG Confidential Information described in this section will be subject to applicable legal requirements that require Service Provider to retain EIG Confidential Information. Upon EIG's request and after EIG Confidential Information has been Destroyed in accordance with the provisions of this section, Service Provider must promptly certify in writing to EIG that it has returned or Destroyed, as applicable, all EIG Confidential Information. Notwithstanding anything to the contrary in the Agreement or this Schedule, in the event of a change in any law or regulation or a change in a governmental interpretation or application of a law or regulation that applies to the Service (a "Change in Law"), to the extent EIG reasonably determines that such Change in Law causes the storage of EIG Confidential Information by EIG in the Service to violate applicable law or regulation, and EIG cannot implement a commercially reasonable change to its configuration or use of the Service to avoid such violation, then EIG may so notify Service Provider in writing. If within thirty (30) days after such notice Service Provider does not make available to EIG a change in the Service or a recommended change in EIG's configuration or use of the Service that will avoid such violation without unreasonably burdening EIG, then EIG may terminate this Agreement upon written notice to Service Provider and receive a refund of any prepaid fees for the period following the effective date of termination. Each party represents as of the Amendment Effective Date that it is unaware of any applicable law, regulation, or prospective Change in Law that would be violated by Service Provider’s storage of EIG Confidential Information in connection with the Services.

5.1 Notwithstanding anything to the contrary in the Agreement, Service Provider will implement and maintain industry standard practice administrative, technical and physical measures that are designed to protect the security, integrity, confidentiality, and availability of EIG Confidential Information, including without limitation, protecting EIG Confidential Information against threats (actual or anticipated) or hazards, improper, unauthorized or unlawful access, use or disclosure, any reasonably anticipated loss, or any other reasonably anticipated compromise, and will internally review such security measures and maintain such security measures in a manner consistent with applicable industry prevalent standards.

5.2 Service Provider will encrypt all electronic EIG Confidential Information that is (a) required to be encrypted under applicable laws, regulations, or standards (including without limitation PCI standards), when transmitted or stored electronically. Service Provider will use security technologies (including without limitation database encryption, intrusion detection and prevention, anti-virus, anti-malware, security event/incident monitoring, encryption, password protection and firewall protection) in providing the Services. In no event will Service Provider permit any other third party to undertake, mining of any content of EIG Confidential Information

 

5.3 Where applicable, Service Provider will use a security-conscious software development lifecycle for software engineering that will [**]. Service Provider will additionally ensure production data is not replicated or used in a non-production environment.

 

5.4 Service Provider will maintain a training program for all employees, contractors and temporary workers with access to, or likely to have access to, EIG Confidential Information, in written or electronic form. The training program will include without limitation updates throughout the year, instruction on maintaining awareness and compliance with security policies, procedures, standards and applicable regulatory requirements.

 

5.5 Service Provider will maintain access control policies, processes and procedures for segregation of duties and granting and timely revocation of Service Provider employee, contractor or temporary worker normal and privileged access to, without limitation, EIG Confidential Information, applications, databases, servers, network infrastructure in accordance with best industry practice. Service Provider’s management will approve and be aware of privileged access and will monitor for inappropriate actions.

5.6 Service Provider will define policies, processes and procedures establishing business continuity and disaster recovery requirements, as well as a method for determining the impact of any disruption to the organization incorporating: [**].

5.7 Service Provider will disclose all non-US locations involved in the delivering the Services including but not limited to software engineering and customer support.

5.8 In addition to PCI obligations, Service Provider will perform [**] Testing (the “Test”) of its corporate non-PCI infrastructure to verify the sufficiency of its security measures, and in a reasonable timeframe undertake commercially reasonable efforts to remedy any critical defect detected in such assessment report. The Test will be performed by an industry recognized security firm, or individual, of sufficient knowledge and skill to attempt non-standard approaches to the Test. A summary of the results of the Test and Service Provider’s plan for addressing or resolving critical items will be shared with EIG within [**] of the Service Provider’s receipt of the results. The Test should, at a minimum, [**]. Service Provider further agrees that where an incident is declared a Test and Vulnerability Assessment will be performed as soon as practicable post incident.

5.9 Service Provider will make itself and any employees, subcontractors, or agents assisting Service Provider in the performance of its obligations under the Agreement available to EIG at no cost to EIG to testify as witnesses, or otherwise, in the event of litigation or administrative proceedings against EIG, its directors, officers, agents or employees based upon a claimed violation of laws relating to security and privacy and arising out of this Agreement.

5.10 The obligations of this Section 5 will not act to restrict Service Provider's lawful disclosure of the EIG Confidential Information pursuant to any applicable state or federal laws or by request or order of any court or government agency. Provided, however, before making such a disclosure, Service Provider must give notice as described in Section 9.2.

5.11 In the event: (a) of an incident which has a significant impact or urgency for EIG’s business, in EIG’s sole discretion, and which demands a response beyond the routine incident management process but does not

meet the criteria of a Security Incident under Section 1.7 (a “Major Incident”); or (b) EIG is required by law and has demonstrated such need to Service Provider, Service Provider must provide within a reasonable timeframe, any data stored regarding any person affiliated with EIG, access logs, activity logs, transaction logs, changes to access rights, etc., as detailed by the system architecture and practices provided by Service Provider, including without limitation:

[**]

7.1 Service Provider will have appropriate staff on duty 24/7/365, and on site during regular Service Provider business hours, capable of identifying, categorizing and responding to a security or privacy incident and will at all times maintain an adequate and appropriate data security and privacy incident management program. In the event there is, or Service Provider reasonably believes that there is, a Security Incident, Service Provider will promptly notify EIG, subject to any legal or regulatory requirements to which Service Provider must adhere, and will promptly take steps to implement a security fix across the Services. Service Provider will promptly, but no later than [**], after discovering a Security Incident, notify EIG in writing of the Security Incident. Further, Service Provider will:

 

7.2 Notwithstanding the foregoing, if Service Provider is found to have engaged in negligent acts in connection with its obligations under the Agreement, Service Provider will be responsible for all costs and expenses in connection with its participation in any EIG or governmental investigations regarding EIG Confidential Information or the provision of the Services.

 

7.3 The content and provision of any notification by EIG of the Security Incident will be solely at the discretion of EIG, provided EIG will not name Service Provider in any notification unless mutually agreed by both parties in writing, unless otherwise required by applicable law or government request.

[**]

Service Provider will ensure that each approved Subcontractor will comply with terms not less stringent than the terms of this Schedule as may be applicable to such obligations arising out of the Agreement as are performed by such Subcontractor. Service Provider will be legally responsible to EIG for any compensable damages under this Agreement suffered by EIG attributable to any Subcontractor engaged by Service Provider to perform any part of Service Provider's obligations under this Agreement, without prejudice to Service Provider's ability to assert and pursue any claim against any such Subcontractor. If Service Provider has knowledge of a reasonably suspected or actual violation of Service Provider's obligations under this Agreement by a Subcontractor, Service Provider will notify EIG promptly in writing (email permitted). If EIG determines that such Subcontractor has violated Service Provider's obligations with respect to EIG Confidential Information, EIG reserves the right to require Service Provider to stop using the Subcontractor for any of the Services provided to EIG promptly and to require the Subcontractor to return or destroy all EIG Confidential Information in Subcontractor's possession or control promptly. Notwithstanding anything to the contrary in the Agreement or this Schedule, Subcontractors will not disclose or allow access by any other party to any EIG Confidential Information without the prior written consent (email permitted) of EIG, except to the extent such disclosure or access is required by applicable law.

10.1 On [**] basis, EIG may ask Service Provider to complete a privacy and security questionnaire as part of its [**] compliance program. Additionally, upon reasonable advance notice to Service Provider and during normal business hours, EIG may conduct a site visit of the Facilities, subject to the following: (a) such visit will be at EIG’s expense and be conducted by representatives of EIG, including without limitation its independent third-party auditor; (b) such site visit will occur at a mutually agreeable time not more than [**] per Service Provider Facility (other than a visit in connection with a Security Incident); (c) such site visit will not unreasonably interfere with Service Provider's operations and will be of reasonable duration; and (d) any third party performing such site visit on behalf of EIG will execute a nondisclosure agreement with Service Provider in a form reasonably acceptable to Service Provider with respect to the confidential treatment and restricted use of Service Provider’s confidential information. If during a site visit, EIG discovers a problem with privacy, security or other operational matters that violate Service Provider’s obligations under the Agreement, EIG and Service Provider will use commercially reasonable and good faith efforts to remediate such problems ("Remediation Plan"). Service Provider will execute and complete the Remediation Plan without unreasonable delay, and, upon request, notify EIG when such actions are completed.

10.2 In the case of a Security Incident, Service Provider will initiate a call with EIG regarding the Security Incident within [**] of the Security Incident, which is in addition to the notification requirement under Section 7.1 of this Schedule. EIG may conduct a site visit within [**] after the initial notice of the Security Incident from Service Provider to EIG. Access to the Facilities will be subject to Service Provider's reasonable access requirements, technical restrictions, and security policies. [**] prior to a scheduled site visit (other than a visit in connection with a Security Incident), EIG will provide Service Provider with a list of records that EIG would like to inspect ("Records Request"). If Service Provider objects to EIG reviewing particular records, Service Provider will notify EIG promptly and the parties will discuss the matter in good faith to arrive at a mutually agreed Records Request. Service Provider will have the mutually agreed Records Request available for EIG's inspection on the agreed site visit date (unless another time is mutually agreed to). If Service Provider, in good faith, is not able to have such information available at that time, Service Provider will notify EIG in advance, but no less than [**] prior to the site visit date, and the parties will decide whether to proceed with the visit. If the parties decide to reschedule the visit, the new date will be no more than [**] after the originally scheduled date. Notwithstanding the foregoing, if during a site visit, EIG discovers a problem with security or other operational matters that violates Service Provider's obligations hereunder, EIG and Service Provider will use commercially reasonable and good faith efforts to create a Remediation Plan. Service Provider will execute and complete the Remediation Plan without unreasonable delay, and, upon request, notify EIG when such actions are completed.

11. Background Checks

11.1 As of the Amendment Effective Date, Service Provider will conduct background checks on all new full-time, contract and temporary personnel involved in the performance of Services for EIG under the Agreement consistent with the below:

11.2 For employees hired prior to the Amendment Effective Date, Service Provider shall complete background checks as set forth in Section 11.1 above for all key personnel who have privileged access to DWTPL’s systems or access to financial information (“Key Personnel”) within [**] of the Amendment Effective Date. For all non-Key Personnel hired prior to the Amendment Effective Date, Service Provider has conducted basic background checks, including:

[**]

This Schedule and related provisions in the Agreement will survive so long as Service Provider has access to or retains EIG Confidential Information. Notwithstanding the foregoing, the following provisions in this Schedule will survive indefinitely: Sections 4 and 9.