This Agreement is made on the 1st day of January 2023

Between

M.C.D. Technologies

And:

[PARTY B]

Parties

M.C.D. Technologies ("MCD"), a corporation organized under the laws of Delaware, with its principal place of business at [ADDRESS].

[PARTY B], [BUSINESS STRUCTURE] organized under the laws of [STATE], with its principal place of business at [ADDRESS].

Background

MCD and [PARTY B] have a business relationship where MCD provides [PRODUCT/SERVICE] services to customers located in the European Union (EU).

In order to enable [PARTY B] to support the delivery of certain [PRODUCT/SERVICE] functionality to MCD's EU customers, it is necessary for MCD to transfer certain personal data of EU customers to [PARTY B] in the United States.

The transfer of personal data from MCD in the EU to [PARTY B] in the United States constitutes an international transfer under Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR).

In order to legally justify such international transfers of personal data under the GDPR, the parties wish to establish these Binding Corporate Rules to ensure an adequate level of protection for the personal data.

Definitions

Binding Corporate Rules (BCRs) means these binding corporate rules agreed to between MCD and [PARTY B] regarding the protection of personal data transferred from the European Union to [PARTY B] in the United States.

Data Controller shall have the same meaning as in the GDPR.

Data Processor shall have the same meaning as in the GDPR.

Data Subject shall have the same meaning as in the GDPR.

EU means the European Union.

GDPR means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.

Personal Data shall have the same meaning as in the GDPR.

Processing/Process shall have the same meaning as in the GDPR.

Standard Contractual Clauses (SCCs) means the standard data protection clauses adopted by the European Commission as a legal basis for international transfers of personal data.

Supervisory Authority shall have the same meaning as in the GDPR.

Third Country shall have the same meaning as in the GDPR.

Transfer shall have the same meaning as making personal data available to recipients in a third country.

Scope

Categories of data subjects and personal data

These Binding Corporate Rules apply to the following categories of personal data: [list].

These Binding Corporate Rules apply to personal data relating to the following categories of data subjects: [list].

Purpose limitation

Personal data covered by these Binding Corporate Rules may be processed only for the following purposes: [list business purposes].

Personal data shall not be processed for any purpose that is incompatible with the business purposes listed in clause 2.2.1.

Data transfers

These Binding Corporate Rules apply to international transfers of personal data from the EU to [PARTY B] in the United States.

The following group companies and third parties may receive personal data covered by these Binding Corporate Rules: [list].

Territorial scope

These Binding Corporate Rules apply to the processing of personal data by MCD and [PARTY B], regardless of where that processing takes place.

Obligations of the Parties

M.C.D. Technologies' Obligations as Data Controller

M.C.D. Technologies shall transfer personal data to PARTY B only for the purposes of providing [PRODUCT/SERVICE] services to M.C.D. Technologies' customers located in the European Union.

M.C.D. Technologies shall ensure that each transfer of personal data to PARTY B is necessary for the purposes of the contract between M.C.D. Technologies and PARTY B.

M.C.D. Technologies shall provide information to data subjects about the international transfers of personal data to PARTY B in the United States.

PARTY B's Obligations as Data Processor

PARTY B shall process personal data only on documented instructions from M.C.D. Technologies for the limited purposes described in Section 3.1.1.

PARTY B shall implement appropriate technical and organizational security measures to protect personal data.

PARTY B shall only use authorized sub-processors to process personal data with M.C.D. Technologies’ prior consent.

PARTY B shall assist M.C.D. Technologies in complying with requests from data subjects to exercise their rights and in notifying personal data breaches.

At the end of the provision of services, PARTY B shall delete or return all personal data to M.C.D. Technologies.

PARTY B shall submit to audits and inspections conducted by M.C.D. Technologies or another auditor mandated by M.C.D. Technologies.

PARTY B shall notify M.C.D. Technologies without undue delay if PARTY B is unable to comply with these Binding Corporate Rules.

Term and Termination

Effective date. This Agreement shall be effective from the date of last signature below ("Effective Date").

Initial term and renewal. The initial term of this Agreement shall be two (2) years from the Effective Date ("Initial Term"). This Agreement shall automatically renew for successive one (1) year terms after the Initial Term unless a Party provides notice of non-renewal to the other Parties at least sixty (60) days before the end of the then-current term.

Termination for cause. A Party ("Non-Breaching Party") may terminate this Agreement if another Party ("Breaching Party") materially breaches this Agreement and such breach:

is incapable of cure; or

being capable of cure, remains uncured thirty (30) days after the Non-Breaching Party provides the Breaching Party with written notice of such breach.

Termination without cause. A Party may terminate this Agreement without cause by providing one hundred eighty (180) days' advance written notice to the other Parties.

Effect of termination. Upon termination of this Agreement, each Party shall immediately cease any processing of personal data and, at the direction of the data exporter, return or delete all personal data in accordance with Clause 6.6.

Confidentiality

Definition of Confidential Information. For purposes of this Agreement, "Confidential Information" means:

All personal data as defined in the GDPR;

All commercially sensitive information, trade secrets, and know-how;

Pricing and financial information with respect to the products and services offered or purchased under this Agreement;

Marketing and business plans and forecasts; and

Any other information that should reasonably be understood to be confidential given the nature of the information and circumstances surrounding disclosure.

Obligation of Confidentiality. Each party agrees:

To keep Confidential Information secret and confidential, to use Confidential Information only for the purposes of this Agreement; and

To implement appropriate technical and organizational measures to protect Confidential Information at a level that is at least as protective as that required by the GDPR.

Exceptions. The obligations in Section 5.2 shall not apply to Confidential Information that:

Is already in the receiving party's rightful possession without an obligation of confidentiality prior to receipt from the disclosing party;

Is or becomes publicly known through no fault of the receiving party;

Is rightfully received by the receiving party from a third party without an obligation of confidentiality;

Is independently developed by the receiving party without use of or reference to the Confidential Information; or

Is required to be disclosed by law, court order or other valid legal process, provided the receiving party promptly notifies the disclosing party and reasonably cooperates in any effort by the disclosing party to limit or prevent public access or disclosure.

Duration. The obligations of confidentiality under this Section 5 shall continue indefinitely, even after termination of this Agreement.

Representations and Warranties

Each party represents and warrants that:

It complies with applicable privacy and data protection laws including the General Data Protection Regulation (GDPR) and United States federal and state privacy and data security laws;

It complies with these Binding Corporate Rules;

Any processing of personal data under these Binding Corporate Rules meets a lawful basis for processing under Article 6 GDPR;

It has implemented appropriate technical and organizational security measures to protect personal data processed under these Binding Corporate Rules;

Any subprocessors engaged to process personal data under these Binding Corporate Rules comply with the same or equivalent security obligations;

It will assist the other party in fulfilling any requests from data subjects to exercise their rights under the GDPR and applicable privacy laws;

Any transfers of personal data to a third country comply with the requirements of Chapter V GDPR; and

It will notify the other party of any personal data breach concerning personal data processed under these Binding Corporate Rules without undue delay.

Each party further represents and warrants that:

It maintains records of processing activities under its responsibility as required by Article 30 GDPR; and

It will cooperate with supervisory authorities as required by the GDPR.

Indemnification

Mutual Indemnification. Each Party (the "Indemnifying Party") shall defend, indemnify, and hold harmless the other Party (the "Indemnified Party") from and against any and all third party claims, losses, damages, judgments, costs and expenses (including reasonable attorneys' fees) (collectively, "Losses") arising out of or resulting from the Indemnifying Party's breach of this Agreement.

Limitation of Liability. Neither Party shall be liable to the other for any indirect, incidental, special, consequential or punitive damages. A Party's total liability shall not exceed the total amount paid or payable by [PARTY B] to MCD under this Agreement in the twelve (12) month period preceding the event giving rise to the claim.

Contribution. If a third party claim is based on the actions of both Parties, costs and damages will be shared in proportion to each Party's responsibility for the claim.

Survival. The indemnification and limitation of liability obligations shall survive termination of this Agreement.

Procedure. The Indemnified Party shall promptly notify the Indemnifying Party of any third party claim and give full discretion and authority to the Indemnifying Party to defend or settle the claim. The Indemnified Party shall provide reasonable assistance to the Indemnifying Party in defending or settling such claim.

Dispute Resolution

The parties shall cooperate and negotiate in good faith to resolve any dispute arising out of or in connection with these Binding Corporate Rules.

If the parties are unable to resolve a dispute pursuant to Clause 8.1 within sixty (60) days of notice of such dispute being served, the parties shall attempt to resolve the dispute by mediation.

The mediation shall be conducted by a mediator appointed by agreement between the parties or in default of agreement upon the application of either party by the American Arbitration Association.

The mediation shall be conducted in accordance with the AAA Mediation Rules.

The costs of the mediation shall be borne equally by the parties.

If the dispute is not settled by mediation within sixty (60) days of the mediation commencing, the dispute shall be referred to and finally resolved by arbitration under the Commercial Arbitration Rules of the American Arbitration Association.

The arbitration shall take place in [City/State] and the language of the arbitration shall be English.

The costs of the arbitration shall be borne equally by the parties.

The arbitrator's award shall be final and binding on the parties.

Nothing in this Clause 8 shall prevent either party from applying to a court of competent jurisdiction for interim or conservatory measures or emergency relief.

The performance of obligations under these Binding Corporate Rules shall continue during the dispute resolution process.

General Provisions

Governing Law and Jurisdiction. This Agreement shall be governed by and construed in accordance with the laws of the State of [APPLICABLE STATE], United States, without regard to its conflict of laws provisions. Any legal suit, action or proceeding arising out of or related to this Agreement shall be instituted exclusively in the federal courts of the United States or the courts of the State of [APPLICABLE STATE]. Each party irrevocably submits to the exclusive jurisdiction of such courts in any such suit, action or proceeding.

Entire Agreement. This Agreement constitutes the entire agreement between the parties with respect to the subject matter hereof. There are no agreements, representations or warranties between the parties other than those set forth or provided for herein.

Severability. If any provision of this Agreement is held by a court of competent jurisdiction to be invalid, illegal, or unenforceable, such provision shall be severed and enforced to the extent possible or modified in such a way as to make it enforceable, and the invalidity, illegality, or unenforceability thereof shall not affect the validity, legality, or enforceability of the remaining provisions of this Agreement.

No Waiver. No waiver of any term or condition of this Agreement shall be valid or binding on either party unless the same shall have been mutually assented to in writing by both parties. The failure of either party to enforce at any time any of the provisions of this Agreement, or the failure to require at any time performance by the other party of any of the provisions of this Agreement, shall in no way be construed to be a present or future waiver of such provisions, nor in any way affect the right of either party to enforce each and every such provision thereafter.

Amendments. No amendment to this Agreement shall be effective unless it is in writing and signed by duly authorized representatives of both parties.

Notices. All notices, requests, consents, claims, demands, waivers and other communications hereunder shall be in writing and addressed to the parties at the addresses set forth on the first page of this Agreement (or to such other address that may be designated by the receiving party in writing from time to time in accordance with this section). All notices shall be delivered by personal delivery, nationally recognized overnight courier (with all fees pre-paid), facsimile or email (with confirmation of transmission) or certified or registered mail (in each case, return receipt requested, postage prepaid).

Assignment. Neither party may assign any of its rights or obligations hereunder, whether by operation of law or otherwise, without the prior written consent of the other party. Any purported assignment in violation of this section shall be null and void.

Relationship of the Parties. The relationship between the parties is that of independent contractors. Nothing contained in this Agreement shall be construed as creating any agency, partnership, joint venture or other form of joint enterprise, employment or fiduciary relationship between the parties, and neither party shall have authority to contract for or bind the other party in any manner whatsoever. IN WITNESS WHEREOF, the parties hereto have caused this Agreement to be executed by their duly authorized representatives as of the [DATE OR EVENT].[PARTY B] [M.C.D. TECHNOLOGIES]

___________________________ ___________________________

Name: Name: Michael Durepeau

Title: Title: Owner