Services Agreement by and between Western Digital Technologies, Inc. and One Stop Systems, Inc., dated as of July 1, 2017

1. SERVICES, STATEMENT OF WORKS, AND CHANGES TO SOW

1.1 Services. Subject to the terms and conditions of this Agreement and at WDT’s request and direction, Consultant will perform for WDT the services described in one or more Statements of Work or SOW (as defined below) (the “Services”) on a non-exclusive basis, without any minimum commitment from WDT as to volume, scope or value. If any services, functions or responsibilities not specifically described in this Agreement or the applicable SOW are an inherent, necessary or customary part of the Services or are required for proper performance or provision of the Services in accordance with this Agreement or such SOW, they shall be deemed to be included within the scope of the Services to be delivered for the agreed upon fees, as if such services, functions or responsibilities were specifically described in this Agreement or the applicable SOW.

1.2 Statement of Work. The specific details of the Services to be performed will be determined on a per-project basis, and the details for each project will be described in a written SOW, substantially in the form of the SOW set forth in Exhibit A, that is executed by both parties (each, a “Statement of Work” or “SOW”). Once executed by both parties, each SOW will be a unique agreement that incorporates the terms of this Agreement and stands alone with respect to all other Statements of Work. If there is a conflict between the terms of this Agreement and the terms of a SOW, the terms of this Agreement will control unless the SOW states that a specific provision of this Agreement will be superseded by a specific provision of the SOW.

1.3 Changes to SOW. WDT may request reasonable changes to the SOW prior to completion. No such proposed changes, including without limitation any associated changes in the price, payment schedules, and projected completion dates, shall be effective unless accepted in writing by authorized representatives of both the parties. WDT may reasonably request in writing that revisions be made with respect to the Services or deliverables set

forth in a SOW (each, a “Change Order”). If a Change Order recites revisions that materially increase the scope of the Services or the effort required to deliver deliverables under the applicable SOW, then within 5 business days after Consultant’s receipt of such Change Order, Consultant will deliver to WDT a written, revised SOW reflecting Consultant’s reasonable determination of the revised Services, deliverables, delivery schedule, and payment schedule, if any, that will apply to the implementation of the revisions. If WDT approves the revised SOW, then the parties will execute it, and upon execution, the revised SOW will supersede the then-existing SOW. If WDT does not approve the revised SOW within five (5) business days after its receipt, the then-existing SOW will remain in full force and effect, and Consultant will have no further obligation with respect to the applicable Change Order.

2. PERFORMANCE OF SERVICES

2.1 Performance Standard. Consultant will diligently perform the Services in accordance with the applicable SOW, including any specifications in the SOW. Consultant will use its best efforts to complete the Services, including the delivery of any Work Products (as defined below), in accordance with the schedule of times and milestones specified in the SOW.

2.2 Subcontractors. Consultant shall not utilize subcontractors or third parties (each a “Third Party” or collectively, “Third Parties”) to perform material parts aspects of the Services without WDTs prior written approval. If Consultant uses Third Parties in performance of the Services, the obligations in this Agreement (and any applicable SOW) shall apply equally to Consultant and Third Parties. Consultant shall inform such Third Parties of the obligations hereunder and ensure that such Third Parties cooperate and fully comply with the requirements of this Agreement and applicable SOW. Consultant shall be fully responsible and liable to WDT for all acts and omissions of Third Parties as if Consultant had performed the work of such Third Parties, and Consultant shall indemnify and hold

WDT harmless from any breach of these obligations by the Third Parties. WDT, in its sole discretion, may restrict Consultant from using a Third Party or require that a Third Party be removed from the performance of Services, for any or no reason.

2.3 Compliance with WDT Policies. If Services are to be performed at a WDT site or using WDT systems, Consultant’s employees, agents, subcontractors, and Third Parties shall comply at all times with WDT’s health, safety, security, and electronic media policies and procedures, including WDT’s Worldwide Code of Business Conduct and Ethics Policy and WDT Supplier Code of Ethical Conduct available at http://www.sandisk.com.

2.4 Compliance with Data Usage and Protection. Consultant represents and warrants that Consultant’s Personnel will comply with the Data Usage and Protection Exhibit attached as Exhibit B. The purpose of Exhibit B is to establish requirements for Consultant for the collection, use, retention, and disclosure of Personal Data (as defined in Exhibit B) related to WDT, WDTs customers, prospective customers, online visitors and business partners. Personal Data may not be added to any database unless it is collected in accordance with Exhibit B and with WDT’s prior written consent.

2.5 Materials. Except as otherwise specified in a SOW, Consultant will be responsible for and supply all necessary equipment, materials, and other resources required to perform the Services.

2.6 WDT Materials. Except for certain tools transferred to Consultant under the License Agreement, Any materials provided by WDT to Consultant are to be used solely to perform the Services. WDT will own these materials as well as any derivatives or improvements of these materials developed or derived by Consultant (“WDT Materials”). Consultant will treat the WDT Materials as WDTs Confidential Information (as defined in Section 4 of the License Agreement and Section 7 of this Agreement). Except for normal wear and tear associated with permitted use of the WDT Materials, Consultant will assume all risk of loss, damage, theft, or destruction of the WDT Materials while they are in Consultant’s possession or control or that of Consultant’s agents, and will reimburse WDT for any such costs of repair or replacement. Consultant will keep the WDT Materials free of all security interests, liens, and other encumbrances.

2.7 Audits. WDT may visit Consultant’s facilities, and Consultant shall ensure WDT has the right to visit Third Parties’ facilities, at reasonable times and with reasonable frequency during normal business hours to observe the performance of the Services and Consultant shall provide WDT access to Consultant’s records and other pertinent information, all to the extent relevant to the Services and Consultant’s obligations under this Agreement.

3. RESERVED

4. RESERVED

5. COMPENSATION

5.1 Fees. The fees to be paid by WDT to Consultant in consideration for the services and deliverables rendered pursuant to this Agreement will be set out in the applicable SOW.

5.2 Invoices. Invoices referencing the applicable WDT purchase order and SOW must be submitted to Western Digital Technologies, Inc., 951 SanDisk Drive, Milpitas, CA 95035-7933, ATTN: ACCOUNTS PAYABLE, with a copy to the WDT manager as identified in the applicable SOW. Payment by WDT will be issued within sixty (60) days from WDT’s receipt of an undisputed invoice; provided, that (i) if any such invoices are due by the 5th of the month, such invoice shall be paid by the end of the first fiscal week of that month and (ii) if any such invoice is due after the 5th of the month, such invoice shall be paid by the end of the first fiscal week of the following month. Charges for freight expenses must be pre-approved by WDT in writing and billed at actual cost, and invoices containing such charges shall be accompanied by receipts and supporting documentation. WDT shall not be liable for any travel expenses unless such expenses are pre-approved in writing by WDT and incurred in accordance with WDT’s consultant travel policy (which will be provided upon request). WDT shall not be obligated to pay any invoice from Consultant or on Consultant’s behalf more than ninety (90) days after WDT has accepted the applicable Work Product. WDT is entitled to apply any credit or excess payment against other payments or obligations to Consultant.

5.3 Taxes and Withholdings. WDT shall pay all taxes relating to the Work Products, except franchise taxes or taxes based upon the income of Consultant. Consultant acknowledges and agrees that WDT has the right to withhold any applicable taxes from any payments due under this Agreement if required under the applicable law or by any government agency. All prices stated in an SOW

under this Agreement is hereby deemed to include all applicable taxes, duties, tariffs and similar liabilities whatsoever for delivery of all Work Products to WDT. Consultant is solely responsible for all wages and other compensation, and for all federal, state, local, FICA and other similar withholding and payments required in connection with Consultant or Consultant’s employees, associates, contractors, agents, affiliates and other representatives (“Consultant’s Personnel”).

6. TERM AND TERMINATION

6.1 Term. This Agreement commences on the Effective Date and continues unless terminated in accordance with the terms of this Section 6.

6.2 Termination by Either Party. Either party may terminate this Agreement and/or any SOW by written notice (a) if the other party fails to cure any material breach within thirty (30) days of receipt of written notice of such breach; (b) if the other party becomes involved in any voluntary or involuntary bankruptcy proceeding or any other proceeding concerning insolvency, dissolution, cessation of operations, reorganization or indebtedness or the like and the proceeding is not dismissed within sixty (60) days; or (c) if the other party becomes insolvent or unable to pay its debts as they mature in the ordinary course of business or makes an assignment for the benefit of its creditors.

6.3 Termination by WDT. This Agreement and/or any SOW may be terminated in whole or in part, by WDT, at any time for convenience upon WDT giving at least five (5) days prior written termination notice to Consultant. In such an event, WDT shall pay to Consultant termination charges computed in the following manner for completed work: (1) undisputed invoiced amounts received by WDT but not yet paid; and (2) reimbursement of preapproved actual and reasonable costs incurred by Consultant prior to the date of termination; provided, however, Consultant shall endeavor to mitigate costs after receiving such termination notice from WDT. WDT shall not be liable to Consultant for any costs which would not have been charged had this Agreement not been terminated nor for any sum in excess of the total price stated in this Agreement for the terminated Services. In the event of any cancellation or termination of this Agreement and/or any SOW, Consultant will return all prepaid fees and credits in excess of the amounts due to Consultant under this Section 6.3. Consultant will return all such prepaid fees and credits within thirty (30) days of the termination effective date.

6.4 Survival. Upon termination, all rights and duties of the parties toward each other cease except that:

(a) Within 5 business days of the effective date of termination, Consultant will return to WDT any amount paid to Consultant as a retainer or prepayment that is not owed against Services; and

(b) Sections 2.2, 2.4, 2.6, 6.3, 6.4, 6.5, 7, 10, 11, 12, 13, and any other section, by its nature should survive, will survive termination or expiration of this Agreement.

6.5 Return of Materials. Upon the termination of this Agreement, or upon WDT’s earlier request, Consultant will deliver to WDT all WDT Materials (as defined in Section 2.6) and Confidential Information (in accordance with Section 7) that are in Consultant’s possession or control.

7. CONFIDENTIALITY. Section 4 of the License Agreement is incorporated herein by reference. In addition, the term “Confidential Information,” as used therein, includes information exchanged between the parties that relates to the Services.

8. RESERVED

9. CONSULTANT’S WARRANTIES

Consultant represents, warrants and covenants as follows:

9.1 Organization Representations; Enforceability.

Consultant is duly organized, validly existing, and in good standing. The execution and delivery of this Agreement by Consultant and the transactions contemplated hereby have been duly and validly authorized by all necessary action on the part of Consultant. This Agreement constitutes a valid and binding obligation of Consultant that is enforceable in accordance with its terms.

9.2 No Conflict. The entering into and performance of this Agreement and all SOWs by Consultant does not and will not violate, conflict with, or result in a material default under any other contract, agreement, indenture, decree, judgment, undertaking, conveyance, lien, or encumbrance to which Consultant is a party or by which it or any of Consultant’s property is or may become subject or bound. Consultant will not grant any rights under any future agreement, nor will it permit any lien, obligation, or encumbrances that will conflict with the full enjoyment by WDT of its rights under this Agreement.

9.3 Applicable Law. Consultant will perform all of its obligations hereunder in compliance with all applicable laws, rules, and regulations.

9.4 No Open Source. Any computer program provided as part of an Invention or a Work Product will not contain any software code that is subject to a license requiring, as a condition of use, modification, or distribution of the software code, that the software code or other software code combined or distributed with it be (a) disclosed or distributed in source code form; (b) licensed for the purpose of making derivative works; or (c) redistributable at no charge.

9.5 Services. The Services will be performed in a timely, competent, professional, and workmanlike manner by qualified personnel. For any defective or non-conforming services or deliverables, Consultant’s obligation hereunder shall be promptly to: (i) bring such service or deliverable into compliance with such requirements, at Consultant’s expense, or at WDTs election, (ii) grant WDT a full refund of the compensation paid by WDT relating to the defective services and/or deliverables.

10. INDEMNIFICATION

10.1 Indemnification. Consultant shall indemnify, defend and hold harmless WDT and its officers, directors, employees, shareholders, customers, agents, successors and assigns (“WDT Indemnified Parties”) from and against any and all claims, losses, damages, costs, expenses (including reasonable legal expenses) and settlements that Consultant might agree to resulting from or arising out of (i) the wrongful acts or omissions of Consultant or Consultant’s Personnel; (ii) employment claims; (iii) Consultant’s failure to comply with applicable laws, rules and regulations; (iv) Consultant’s breach of its obligations with respect to WDT Confidential Information; and (v) claims of Intellectual Property Right infringement which alleges that any Work Product or any component thereof infringes upon, misappropriates, or violates any Intellectual Property Rights of a Third Party (each “Indemnified Claim”).

10.2 Settlement. Consultant shall not settle any Indemnified Claim without the written consent of WDT unless the compromise or settlement unconditionally includes the claimant’s or the plaintiffs release of the WDT Indemnified Parties from all liability and the settlement does not impose any affirmative obligation on the WDT Indemnified Parties.

10.3 Remedies. In the event of an Indemnified Claim, Consultant will, in addition to its other obligations set forth in this Section 10, at its expense, at WDT’s option: (i) obtain and confirm to WDT, all rights required to permit the continued sale or use of the Work Product by WDT under this Agreement; (ii) modify or replace such Work Product to make them non-infringing (and extend this indemnity thereto) while still conforming to this Agreement, provided that any such replaced or modified Work Product are satisfactory to WDT; or (iii) at WDT’s request, promptly refund to WDT the fees, plus all shipping, storage and associated costs of any Work Product returned.

11. Limitation of Liability.

11.1 EXCEPT FOR (A) BREACH OF

CONFIDENTIALITY OBLIGATIONS, (B)

CONSULTANT’S INDEMNIFICATION OBLIGATIONS, AND (C) CONSULTANT’S WILLFUL MISCONDUCT OR GROSS NEGLIGENCE, NEITHER PARTY WILL BE LIABLE FOR INDIRECT, PUNITIVE, SPECIAL, INCIDENTAL, EXEMPLARY OR CONSEQUENTIAL DAMAGES IN CONNECTION WITH OR ARISING OUT OF THIS AGREEMENT, HOWEVER IT ARISES, WHETHER FOR BREACH OR IN TORT, INCLUDING BUT NOT LIMITED TO LOSS OF PROFITS, DATA OR BUSINESS INTERRUPTION, EVEN IF THAT PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

11.2 IN NO EVENT SHALL WDT’S TOTAL CUMULATIVE LIABILITY ARISING UNDER THIS AGREEMENT, WHETHER SUCH THEORY OF LIABILITY IS BASED IN CONTRACT, TORT OR OTHERWISE, EXCEED THE TOTAL AMOUNT OF THE PAYMENTS ACTUALLY PAID AND PAYABLE BY WDT UNDER THE AGREEMENT IN THE PRECEDING TWELVE (12) MONTHS PRIOR TO THE DATE THE LIABILITY FIRST AROSE.

12. INSURANCE

Consultant agrees to comply with WDT’s insurance requirements included in the attached Exhibit C.

13. MISCELLANEOUS

13.1 Services and Information Prior to Effective Date. All services performed by Consultant and all information and other materials disclosed between the parties prior to the Effective Date will be governed by the terms of this Agreement, except where the services are covered by a separate agreement between Consultant and WDT.

13.2 Foreign Corrupt Practices Act. Neither Consultant nor any of Consultant’s directors, officers, agents, employees, affiliates or other person associated with or acting on behalf of Consultant or any of its subsidiaries has (i) used any funds for any unlawful contribution, gift, entertainment or other unlawful expense relating to political activity or to influence official action; (ii) made any direct or indirect unlawful payment to any foreign or domestic government official or employee; (iii) made any bribe, rebate, payoff, influence payment, kickback or other unlawful payment; or (iv) violated, or is in violation of, any provision of the U.S. Foreign Corrupt Practices Act of 1977, as amended, the UK Bribery Act 2010, as may be amended, and any other anti-corruption/bribery laws and regulations (“Anti-Corruption Laws”) applicable to Consultant the Services provided under this Agreement. Consultant, Consultant’s directors, officers, agents, employees, affiliates and any other person associated with or acting on behalf of Consultant or any of its subsidiaries represent and warrant that they have conducted their businesses in compliance with the Anti-Corruption Laws, and have instituted and maintain policies and procedures designed to ensure, and which are reasonably expected to continue to ensure, compliance therewith.

13.3 The parties acknowledge and agree that a violation of Section 7 (Confidentiality) may cause immediate and irreparable harm to the other party for which money damages may not constitute an adequate remedy at law. Therefore, the parties agree that the disclosing party shall be entitled to seek appropriate equitable relief in addition to whatever remedies it might have at law, including, without limitation, attorney’s fees, in connection with any breach or enforcement of the obligations hereunder or the unauthorized use or release of any such Confidential Information.

13.4 Sections 11.1 through 11.10 of the License Agreement are incorporated herein by reference.

14. DEFINITIONS

14.1 “Affiliate” means any entity that Controls, is Controlled by, or is under common Control with another person or entity.

14.2 “Control” means more than 50% of the ownership of voting shares, by contract or otherwise; but in any such case: (i) such entity shall be deemed to be an Affiliate only so long as such Control exists, and (ii) such entities that would be considered to be under Control solely as a result of being controlled by a government of any sovereign country are hereby excluded.

14.3 “Intellectual Property Rights” means the collective, worldwide intellectual property and proprietary rights of a party now held or hereafter filed, issued, created or acquired, under statutory or common law in any jurisdiction, including under patent, copyright, trademark, and trade secret law, or acquired by contract, and any and all other proprietary rights whether or not protectable by statutory or common law, including for and in (i) all classes or types of patents and patent applications; (ii) all works of authorship, including all copyrights and moral rights in both published and unpublished works and all registrations and applications; (iii) all mask works and all registrations and applications; and (iv) all discoveries, inventions, ideas, and designs (whether patentable or not), know-how, developments, improvements, trade secrets, and confidential and proprietary technical and non-technical information.

14.4 “License Agreement” means the Technology and Source Code License Agreement between the parties dated the same date as this Agreement.

14.5 “Work Product” shall mean all Services and deliverables to be provided by Consultant as set forth in this Agreement on a non-exclusive basis and as specified in the attached SOWs.

1. SCOPE. Consultant and WDT agree to the terms in this Exhibit regarding the Processing of WDT Data. To the extent that Consultant Processes WDT Data, it will do so as a processor acting on behalf of WDT (as controller) and according to the terms in the Agreement and this Exhibit. Subject to such terms, WDT grants to Consultant a non-exclusive limited license to use WDT Data solely for the purpose identified in the Agreement. In the event of conflict between the terms of this Exhibit and the Agreement relating to data use and protection, the terms of this Exhibit will prevail.

2. DEFINITIONS. The terms “controller” and “processor” shall have the meanings given in the Directives.

2.1. “Consultant” shall have the meaning given in the Agreement.

2.2. “Data Breach” means any accidental or unlawful destruction or accidental loss, alteration, unauthorized disclosure or access or other unlawful forms of processing

2.3. “Data Protection Laws” means data protection and privacy laws of each country where: (a) a WDT entity responsible for WDT Data is established; and (b) WDT Data is processed, including, without limitation the European Data Protection Directive (95/46/EC) and the Privacy and Electronic Communications Directive (2002/58/EC) (collectively, the “Directives”) in the European Economic Area (“EEA”) including any laws which amend, replace and/or supersede the Directives, and in the United States, the Federal Trade Commission Act, the Health Insurance Portability and Accountability Act, the Children’s Online Privacy Protection Act, and any applicable rules issued by a competent data protection authority or governmental body.

2.4. “Opt-in” means an Owner expressly consents to certain uses of his/her Personal Data by taking affirmative action to indicate consent, such as in writing, by checking the appropriate option or box, by affirmative statement, or otherwise at the time of collection.

2.5. “Owner” means any person or data subject about whom Personal Data is Processed.

2.6. “Personal Data” means information on its own or when combined with other data, to enable identification, directly or indirectly, of a person, including but not limited to, email or physical address, name, title, phone number, employer, birth date, gender or other unique identifiers. Personal Data includes Sensitive Personal Data.

2.7. “Processing” (or verb variation thereof) means taking any action, actively or passively, in connection with WDT Data, including, but not limited to: collecting; receiving; using; transferring; disclosing; disseminating; making available; recording; organizing; storing; retaining; altering; accessing; processing; retrieving; consulting on; aligning; combining; blocking; making anonymous; erasing; disposing of; or destroying Personal Data.

2.8. “WDT” shall have the meaning given in the Agreement.

2.9. “WDT Data” means any and all data, information and content (including Personal Data) and whether confidential or not which is made available to or Processed by Consultant on WDT’s behalf.

2.10. “Sensitive Personal Data” means Personal Data identifying race or ethnic origin; religious or philosophical beliefs; political opinions; party membership; criminal records; geo-location data; financial data; health data; sexual behaviors; or other Personal Data which may subject the Owner to embarrassment or harm if disclosed.

3. COMPLIANCE AND COOPERATION. Consultant represents and warrants it will comply with Data Protection Laws in Processing of WDT Data. If the Data Protection Laws impose stricter obligations on Consultant than this Exhibit, the Data Protection Laws shall prevail. Consultant shall provide all cooperation to WDT regarding Processing of WDT Data to enable WDT to comply with any Data Protection Laws. Consultant shall nominate a representative within its organization to promptly and fully respond to WDTs queries regarding Processing of WDT Data.

4. SECURITY AND MANAGEMENT OF WDT DATA. Consultant undertakes, represents and warrants:

4.1. to Process WDT Data only as instructed by WDT, as necessary to fulfill its contractual obligations to WDT and not for its own purposes;

4.2. that access to WDT Data will be limited to those with a legitimate need to know;

4.3. to process WDT Data only for the purpose of providing the tasks and/or services under the Agreement and in accordance with WDT’s lawful instructions;

4.4. to not divulge the whole or any part of WDT Data to any person, except to the extent necessary for the performance of the Agreement and this Exhibit or otherwise in accordance with WDT’s lawful instructions;

4.5. to not do anything relating to WDT Data which may result in WDT’s breach of Data Protection Laws;

4.6. that it has in place current disaster recovery plans in relation to any systems which Process the WDT Data;

4.7. to maintain appropriate technical and organisational security measures to protect WDT Data;

4.8. to immediately notify WDT of any Data Breach and to perform acts in order to remedy or mitigate the effects of the Data Breach and to continuously update WDT of developments. In the event that any WDT Data is lost, damaged or destroyed, Consultant shall promptly restore such WDT Data to the last available backup;

4.9. to promptly notify WDT of all data protection related inquires (including inquiries from any regulator, law enforcement or government agency) or complaints related to WDT Data;

4.10. to provide all assistance reasonably required to enable WDT to respond to or resolve any request, question or complaint received by WDT from any Owner whose Data is processed by Consultant on behalf of WDT; or any regulator, law enforcement or government agency;

4.11. to not disclose WDT Data or Processing details unless at the written instruction of WDT or unless legally compelled, provided that Consultant immediately notify WDT so WDT may seek a protective order;

4.12. to promptly carry out requests from WDT to amend, transfer or destroy the WDT Data; and

4.13. to bear the costs of complying with applicable requirements arising under Data Protection Laws.

4.14. Consultant represents and warrants that when acting on WDT’s behalf:

a) Personal Data will not be collected (including by cookies or other technologies) without providing the Owner with fair, lawful and sufficient notice pursuant to applicable Data Protection Laws.

b) Personal Data will be collected on behalf of WDT solely when the Privacy Statement (located at https://www.wdc.com/about-wd/legal/privacy- policy.html) is clearly available to Owners prior to collection: (a) if online, the Privacy Statement must be linked immediately adjacent to the “submit” (or similar) button and the consent of the Owner must be obtained (e.g., a box which the Owner may choose to check, stating “I understand and agree that my personal information will be used as outlined in the Privacy Statement”); or (b) if by phone, by providing a short and relevant collection notice with direction to the URL of the Privacy Statement for further information; or (c) for all other collections, the Privacy Statement will be made available.

c) Personal Data of a child under age 13 will not be collected.

d) Personal Data collected for marketing or specific targeting purposes may only be Processed for the specific purpose(s) for which the Owner either consented or for which the Owner was provided with adequate notice.

e) Any commercial emails sent by the Consultant will include a functional unsubscribe option.

f) Opt-ins obtained by the Consultant for text messaging must be by a written (such as electronic format), auditable consent by Owner; and text messages sent by Consultant acting on behalf of WDT to a mobile device must comply with the Global Code of Conduct of the Mobile Marketing Association (“MMA”) and any MMA region-based guide (for example, in the U.S., the U.S. Consumer Best Practices for Messaging) or any comparable and applicable in country guidance or best practice.

5. TRANSFER. Consultant represents and warrants not to Process, nor to permit any Sub-Processor (defined below) to Process, WDT Data outside of the jurisdiction in which WDT Data is made available to Consultant (a “Transfer”) except following WDT’s written consent and Consultant’s continued compliance with the terms of this Exhibit.

6. SUB-PROCESSORS. Consultant shall not delegate or subcontract any Processing to another party (“Sub-Processor”) without WDT’s prior written consent provided at WDT’s sole discretion. Consultant shall provide WDT with the identity and role of the proposed Sub-Processor, details relating to security, the location of any data facilities and Processing activities and other data WDT may reasonably request. Consultant shall enter into an agreement with Sub-Processor containing equivalent terms to this Exhibit (provided that Sub-Processor not subcontract or delegate duties without WDT’s consent) which provides WDT with third party beneficiary rights sufficient to enforce any such agreement; or require Consultant to require the Sub-Processor to enter into direct terms with WDT.

7. INDEMNIFICATION. Consultant shall be responsible for all acts and omissions relating to Processing of WDT Data, including the acts or omissions of its personnel, agents and Sub-Processors (each a “Representative”). Consultant agrees to indemnify, hold harmless and, upon WDT’s request, defend WDT and its directors, officers, employees, shareholders and agents from and against any and all damages, liabilities, costs, expenses, claims, fines and losses brought by a third party, including reasonable attorneys’ fees, in connection with, in whole or in part, Consultant’s and/or any Representative’s breach of this Exhibit.

8. AUDIT, INFRASTRUCTURE AND NOTICES.

8.1. Audit. Consultant consents that WDT and its authorized representatives may inspect and audit Processing of WDT Data on Consultant

systems and at its facilities and by electronic monitoring without further notice. If an audit finds non-compliance with this Exhibit, Consultant shall take all reasonable steps to promptly remedy any breach, or provide a detailed report as to why such breach cannot be remedied and pay WDT’s reasonable audit costs.

8.2. Infrastructure Changes. Consultant shall notify WDT of any planned changes to its infrastructure or processes involving WDT Data prior to any change. If WDT believes such change may compromise WDT Data or lead to the breach of any applicable Data Protection Laws, Consultant agrees to modify or delay such changes until WDT’s reasonable concerns are resolved. WDT will have the right to terminate or suspend Processing by Consultant in whole or part without any liability to Consultant until WDT’s issues are resolved.

9. RETURN OF DATA. Upon written request or termination or expiration of this Exhibit, Consultant shall: (i) immediately cease Processing the WDT Data; and (ii) return to WDT in WDT’s preferred format, or at WDT’s option destroy or expunge the WDT Data and all copies or extracts within five days in accordance with the Guidelines for Media Sanitation (Publication 800-88) from the National Institute of Standards and Technology. Upon request, Consultant shall certify in writing its compliance with these obligations.

END OF EXHIBIT