An Data Processing Agreement

6.1 Processing sites. DigitalOcean may transmit and process its customers` data in the United States and anywhere in the world, where DigitalOcean, its related companies and/or subcontractors perform data processing operations. DigitalOcean will take appropriate security measures to protect personal data wherever it is processed, in accordance with the requirements of data protection legislation. Customer, as defined in HubSpot`s Terms of Use for Customers (the „Data Exporter“), „Model Contract Clauses“ or „MCC“, means the Standard Data Protection Clauses relating to the transfer of personal data to processors established in third countries that do not guarantee an adequate level of data protection, as approved by the European Commission in Decision 2010/87/EU, amended, replaced or replaced by a series of clauses approved by the European Commission. The standard clauses of the contract are attached to Annex 4 and shall, where appropriate, forms part of this Agreement. `personal data`, `specific categories of data`, `processing/processing`, `controller`, `processor`, `data subject` and `supervisory authority` shall have the same meaning as in Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data; `data importer` means the processor who agrees to obtain from the data exporter personal data to be processed on his behalf after transmission in accordance with his instructions and the provisions of the clauses and who is not subject to the system of a third country ensuring adequate protection within the meaning of Article 25(1) of Directive 95/46/EC; The data controller must ensure that the volume of the data processor`s DPA does not exceed the initial legal basis for data processing. In other words, the outsourcing company should only be able to use data for the purposes defined in the agreement. It is the responsibility of the person in charge to check how the processor uses the data he transmits to him. d. If necessary, the parties will cooperate appropriately during the healing period in order to agree on additional safeguards or other measures reasonably necessary, if any, to ensure the data importer`s compliance with the applicable data protection clauses and legislation. `personal data` means all customer data relating to an identified or identifiable natural person, to the extent that such information is protected as personal data under applicable data protection legislation.

. . .