comply with all obligations arising for the Personal Data Processor from the applicable legal regulations when processing Personal Data;

process the Personal Data only on the basis of instructions from the Controller made under the Data Processing Agreement, including the area of transferring the Personal Data to a third country or international organization;

notify the Controller without undue delay of cases where an inspection or other proceedings are initiated by a supervisory authority regarding the Personal Data processing by the Processor and provide the Controller with all information on the course and results of such inspection or proceedings;

cooperate with the Controller in ensuring compliance with the Controller’s obligations regarding the security of Personal Data, taking into account the nature of the processing to be carried out by the Processor;

allow the Controller to conduct internal audits, including inspections, performed by the Controller or another auditor commissioned by the Controller (hereinafter the “Audit”). The Processor must be notified of the Audit at least one month in advance. The Processor may object to any auditor commissioned by the Controller if such auditor is not independent or in a competitive or similar position to the Processor. Based on the Processor’s objection, the Controller is obligated to commission another auditor;

notify the Controller of any Personal Data security breach of which the Processor becomes aware without undue delay and no later than 48 hours after becoming aware thereof;

keep records of all Personal Data security breaches and the corrective measures taken to ensure adequate processing security. The Processor is obligated to provide the Controller with all necessary cooperation related to the investigation into the security breaches and performance of the Controller’s obligations;

cooperate with the Controller in documenting processes and documents demonstrating the Controller’s compliance with the applicable personal data security legislation rules.