Data Processing Agreement

1. Parties

This DPA is between:

• Controller: you, the registered user of Volta Connect Studio ("Controller"), and
• Processor: Volta XR Ltd, a company registered in England and Wales ("Volta", "Processor").

This DPA forms part of and is subject to the End User Licence Agreement between you and Volta.

2. Details of Processing

3. Processor Obligations

Volta agrees to:

1. Process personal data only on the documented instructions of the Controller, which for the purposes of this DPA are the Controller's use of the Platform features as described in the EULA. Volta will inform the Controller if it believes any instruction infringes applicable data protection law;
2. Ensure that all persons authorised to process the personal data have committed to confidentiality or are under an appropriate statutory obligation of confidentiality;
3. Implement the technical and organisational security measures described in Annex A;
4. Not engage any sub-processor without prior written authorisation from the Controller (general authorisation is granted by the Controller's acceptance of this DPA for the sub-processors listed in Annex B). Volta will notify the Controller of any intended changes to sub-processors and give the Controller an opportunity to object;
5. Ensure that where sub-processors are engaged, they are bound by data protection obligations equivalent to those in this DPA;
6. Taking into account the nature of the processing, assist the Controller by appropriate technical and organisational measures (insofar as possible) to fulfil the Controller's obligation to respond to data subject rights requests;
7. Assist the Controller in ensuring compliance with its obligations regarding security, breach notification, data protection impact assessments, and prior consultation, taking into account the nature of the processing and the information available to Volta;
8. At the choice of the Controller, delete or return all personal data after the end of the provision of the services, and delete existing copies unless applicable law requires retention. Account deletion requests can be sent to privacy@volta-xr.com;
9. Make available all information necessary to demonstrate compliance with this DPA and contribute to audits conducted by the Controller or a third-party auditor on reasonable prior written notice (no less than 30 days) and at the Controller's cost, no more than once per year unless required by a supervisory authority;
10. Notify the Controller without undue delay (and in any event within 72 hours of becoming aware) of any personal data breach affecting personal data processed under this DPA.

4. Controller Obligations

The Controller agrees to:

• ensure it has a lawful basis under UK GDPR for all personal data processed under this DPA, including obtaining any necessary consents from audience members;
• provide audience members with a privacy notice explaining how their data is processed, including disclosure that a third-party platform (Volta) processes it on the Controller's behalf;
• ensure that any instructions given to Volta comply with applicable data protection law;
• not instruct Volta to process personal data in a way that would breach applicable law.

5. International Transfers

Some sub-processors listed in Annex B are located outside the UK. Transfers to those sub-processors are made under appropriate transfer mechanisms (IDTA or Standard Contractual Clauses). Details are set out in Annex B. Volta will not transfer personal data to any country or recipient not covered by an adequate safeguard without the Controller's prior written consent.

6. Governing Law

This DPA is governed by the law of England and Wales and subject to the jurisdiction of the courts of England and Wales.

Annex A — Technical and Organisational Measures

Annex B — Approved Sub-processors

Volta will notify Controllers of any intended changes to this list (additions or replacements) giving at least 14 days' notice. Controllers may object to changes by contacting privacy@volta-xr.com.