Mercury Payroll Data Processing Addendum

This Data Processing Addendum (“DPA”) supplements the Mercury Payroll Terms of Service (“Payroll Agreement”) and outlines the parties’ obligations with respect to the Processing of any Payroll Personal Data by Mercury Technologies, Inc. and its affiliates and subsidiaries (“Mercury,” “we,” “us,” and “our”) on behalf of the entity or organization accepting the Payroll Agreement and this DPA (“you” and “your”) under the Payroll Agreement. Unless otherwise defined in this DPA or the Payroll Agreement, all capitalized terms used herein have the meanings given to them in Section 13 (Definitions) of this DPA.

1. Data Processing

1.1 Scope

This DPA applies to any Processing of Payroll Personal Data by Mercury under the Payroll Agreement. The subject matter, duration, nature, and purpose of the Processing of the Payroll Personal Data as well as the type of Payroll Personal Data and categories of Data Subjects are described in Appendix 1 (“Details Regarding the Processing”).

1.2 Roles of the Parties

With respect to Payroll Personal Data, Mercury is a Processor (and a “service provider” under the California Consumer Privacy Act (“CCPA”)) and you are a Controller (and a “business” under the CCPA). Where you are a Processor acting on behalf of a third-party Controller, Mercury is a Subprocessor. Mercury or its Subprocessors may collect Payroll Personal Data directly from your employees, contractors, payment beneficiaries, and others on your behalf and at your instruction, including through employee onboarding, benefits enrollment, employment eligibility verification, and payment workflows.

1.3 Use of Payroll Personal Data

Mercury will only Process Payroll Personal Data on your documented instructions, as follows: (a) processing in accordance with the Payroll Agreement, applicable Order Form(s), and Appendix 1; (b) processing initiated by your employees, contractors, or other authorized users in their use of Mercury Payroll and as authorized by you; and (c) processing pursuant to other documented reasonable instructions provided by you that are consistent with the Payroll Agreement. Mercury may only Process Payroll Personal Data otherwise if required or permitted by Data Protection Laws.

1.4 Limitations on Processing of Payroll Personal Data

With respect to Payroll Personal Data, Mercury must not: (i) sell Payroll Personal Data or share Payroll Personal Data for purposes of cross-context behavioral advertising or targeted advertising; (ii) retain, use, or disclose Payroll Personal Data for any commercial purpose except as permitted in this DPA, Order Form(s), Payroll Agreement, or your documented instructions; (iii) retain, use, or disclose Payroll Personal Data outside the direct business relationship between Mercury and you, except as required or permitted by law; or (iv) combine any Payroll Personal Data with Personal Information that Mercury receives from another source, except as otherwise permitted for service providers under the CCPA (including for security, fraud prevention, performance of the Services, repair of existing Service functionality, service improvement and product development, internal analytic and research, and debugging).

1.5 Excluded Processing

This DPA does not govern Mercury’s Processing of Personal Information in any of the following capacities, which are instead governed by the Mercury Privacy Policy or other agreements, as applicable:

• Mercury’s Processing of Personal Information for its own legal, regulatory, and corporate governance obligations that are not otherwise covered by your instructions, including responding to legal process, defending legal claims, and maintaining internal records required by applicable law.
• Financial services obligations and banking relationships. Personal Information Mercury or its affiliated banking and financial services entities Process to provide (i) Mercury’s obligations as a financial services provider, including sanctions screening, anti-money laundering compliance, payment recordkeeping under the Bank Secrecy Act, and tax documentation retention; or (ii) your direct relationship with Mercury or its affiliates for banking or related financial services separate from the Services.

If we Process the same Payroll Personal Data both for you and for an excluded purpose, this DPA still governs the Processing we do for you.

2. Mercury’s Obligations

2.1 Compliance with Data Protection Laws

Mercury will comply with Data Protection Laws applicable to its role as Processor.

2.2 Notification

Mercury will inform you if it believes that (a) your instructions would cause you or us to violate this DPA or Data Protection Laws; or (b) Mercury can no longer comply with this DPA or any Data Protection Laws.

2.3 Assistance

Mercury will reasonably assist you with meeting your obligations under Data Protection Laws, taking into account the nature of Mercury’s Processing and the information available to Mercury. Where you require assistance beyond Mercury’s standard platform functionality or existing audit reports, Mercury will provide such assistance at your reasonable expense.

3. Your Obligations

3.1 Compliance and Lawful Basis

You represent and warrant that you are authorized to submit your employees’ and contractors’ Payroll Personal Data to Mercury for payroll and related processing, that you have informed or will inform those individuals that their data is Processed by a third party, and that your use of the Services complies with applicable Data Protection Laws.

3.2 Authorized Users

You are responsible for ensuring that individuals you authorize to access the Services handle Payroll Personal Data confidentially and only for legitimate business purposes.

3.3 Notification

You will promptly notify Mercury of any matters that materially affect Mercury’s Processing, including Data Subject requests requiring Mercury’s assistance and regulatory inquiries or investigations related to Payroll Personal Data Processed through the Services.

4. Security

Mercury will use appropriate technical and organizational measures to protect Payroll Personal Data from unauthorized or unlawful Processing and accidental loss, destruction, or damage. These measures account for costs, the nature, and purpose of the Processing, and the risks to Data Subjects. Appendix 2 describes them.

5. Security Incidents

5.1 Notification

Mercury will notify you without undue delay after confirming a Security Incident that affects your Payroll Personal Data. Mercury will notify you by email at the contact on file. Notification of a Security Incident under this Section 5 will not be construed as an admission of fault or liability by Mercury. Mercury’s notification and remediation obligations under this Section 5 do not apply to Security Incidents caused by your actions or those of your authorized users.

5.2 Content of the Notification

Mercury’s notification will include, to the extent reasonably known at the time of notification, a general description of the Security Incident and a contact point for further information. Mercury will provide additional information as it becomes reasonably available and as necessary for you to comply with your own notification obligations under Data Protection Laws. Mercury is not required to provide information that would compromise an ongoing investigation, violate law, or breach Mercury’s obligations.

5.3 Mitigation

Mercury will take commercially reasonable steps to investigate, contain, and remediate the effects of the Security Incident. Each party must bear its own costs in responding to a Security Incident, except that Mercury must bear the costs of investigation and remediation to the extent the Security Incident was caused by Mercury’s breach of this DPA.

5.4 Publicity

Neither party may disclose any information related to any Security Incident that identifies the other party without the other party’s prior written consent, unless required by applicable law or by Mercury’s obligations to its regulators.

6. Demonstrating Compliance

6.1 Reports and Certifications

Mercury will maintain industry-standard certifications and audit reports, including SOC 2 Type II reports (or equivalent), covering its Processing of Payroll Personal Data. Mercury’s current certifications and audit reports are available at trust.mercury.com. Such reports will be treated as Mercury’s Confidential Information.

6.2 Audits and Inspections

The audit reports provided under Section 6.1 constitute Mercury’s primary mechanism for demonstrating compliance. If those reports are insufficient to verify Mercury’s compliance with this DPA and an audit is required by applicable Data Protection Laws, you may request an audit of Mercury’s relevant Processing activities. Any such audit is subject to the following: (i) at least 45 days’ prior written notice; (ii) not more than once per calendar year; (iii) conducted during business hours without unreasonable interference with Mercury’s operations; (iv) you must bear all costs associated with the audit, except that if the audit reveals material non-compliance by Mercury with this DPA, Mercury must bear the reasonable costs of the audit; (v) by an auditor (not a Mercury competitor) bound by confidentiality; (vi) the scope limited to Mercury’s compliance with this DPA; and (vii) the parties will mutually agree upon the scope, timing, and duration of the audit and any reimbursement rate for Mercury’s reasonable costs before the audit commences. You must promptly provide Mercury with information regarding any actual or suspected non-compliance with this DPA discovered during the course of an audit.

7. Complaints & Data Subject Requests

7.1 Notification

Mercury will promptly notify you, and in any event within a timeframe that enables you to comply with applicable response deadlines under Data Protection Laws, after receiving any request from a Data Subject to exercise rights under Data Protection Laws with respect to the Processing of your Payroll Personal Data.

7.2 Cooperation

Mercury will provide you with commercially reasonable cooperation and assistance, through Mercury’s standard platform functionality, to enable you to respond to Data Subject requests. Mercury will cooperate, upon request, with any supervisory authority in the performance of its tasks, to the extent such cooperation relates to the Processing of your Payroll Personal Data.

7.3 No Direct Response

Mercury will not respond directly to any Data Subject, except to direct the Data Subject to you, unless authorized by you or required by Data Protection Laws, in which case Mercury will inform you of the legal requirement before responding (to the extent permitted by law).

8. Subprocessing

8.1 General Authorization

You provide general written authorization for Mercury to engage Subprocessors to Process Payroll Personal Data related to the Services.

8.2 Notification and Requirements

Mercury maintains a current list of its Subprocessors at trust.mercury.com. Mercury will update the Subprocessor list at least 10 days before a new Subprocessor begins Processing Payroll Personal Data. If you have a reasonable, documented objection to a new Subprocessor based on data protection grounds, you must notify Mercury in writing within 10 days of the update to the Subprocessor list. Mercury will work in good faith to resolve your objection. If your objection is not resolved within 30 days, you may terminate the portion of the Services that requires the objected-to Subprocessor by written notice to Mercury, as your sole remedy. Your continued use of the Services following an update to the Subprocessor List without objection constitutes acceptance of the updated Subprocessor List.

8.3 Liability

Mercury will be liable for the acts and omissions of its Subprocessors to the same extent Mercury would be liable if performing the relevant Processing directly under this DPA. Where a Subprocessor Processes Payroll Personal Data as your directly authorized agent, such as a reporting agent or third-party administrator for tax filing purposes, acting under your own authorization rather than Mercury’s instructions, that Processing is not performed on Mercury’s behalf and is not subject to this Section 8.3.

8.4 Third-Party Controllers

You acknowledge that certain third parties in the payroll, benefits, tax, employment eligibility verification, and compliance chain (such as insurance carriers and benefits administrators, retirement plan providers, identity and employment eligibility verification vendors, financial institutions and payment providers, and tax and regulatory authorities) may act as independent Controllers with respect to Payroll Personal Data they receive. Processing of Payroll Personal Data by these third parties is governed by their own privacy notices and applicable law.

9. International Transfers

9.1 Processing in the United States

You acknowledge that Mercury primarily Processes Payroll Personal Data in the United States. Mercury and its Subprocessors may Process Payroll Personal Data in other jurisdictions as necessary to provide the Services, subject to the transfer safeguards described in this Section 9. Mercury may not engage in a Restricted Transfer without ensuring that appropriate safeguards are in place as required by Data Protection Laws. Any Restricted Transfer is subject to the following.

9.2 Transfers from the EEA

Where a Restricted Transfer is made from the EEA, such transfers are made under the EU SCCs, which are hereby deemed entered into (and incorporated into this DPA by reference) and completed as follows:

• Module Two (Controller to Processor) of the EU SCCs apply when you are a Controller and Mercury is Processing Payroll Personal Data for you as a Processor.
• Module Three (Processor to Subprocessor) of the EU SCCs apply when you are a Processor and Mercury is Processing Payroll Personal Data on behalf of you as a Subprocessor.
• For each module, where applicable the following applies:
  • The optional docking clause in Clause 7 does not apply;
  • In Clause 9, Option 2 (general written authorization) applies, and the minimum time period for prior notice of subprocessor changes will be as set forth in Section 8 (Subprocessing);
  • In Clause 11, the optional language does not apply;
  • In Clause 13, the competent supervisory authority is the Irish Data Protection Commission;
  • In Clause 17 (Option 1), the EU SCCs will be governed by the laws of Ireland;
  • In Clause 18(b), disputes will be resolved before the courts of Ireland;
  • The information required in Annex I of the EU SCCs is hereby populated with the information in Appendix 1 (Details Regarding the Processing) of this DPA. You will be the ‘data exporter’ and Mercury will be the ‘data importer’;
  • Appendix 2 (“Security Measures”) to this DPA contains the information required in
  • Annex II of the EU SCCs; and
  • By entering into this DPA, we are deemed to have signed the EU SCCs as incorporated herein, including their Annexes.

9.3 Transfers from Switzerland

Where a Restricted Transfer is made from Switzerland, the EU SCCs apply to the transfer except that:

• in Clause 13, the competent supervisory authority is the Swiss Federal Data Protection and Information Commissioner if the Restricted Transfer is governed by the Swiss Federal Act on Data Protection;
• references to “Member State” in the EU SCCs refer to Switzerland, and data subjects located in Switzerland may exercise and enforce their rights under the EU SCCs in Switzerland; and
• references to the “General Data Protection Regulation,” “Regulation 2016/679,” and “GDPR” in the EU SCCs refer to the Swiss Federal Act on Data Protection (as amended or replaced).
• The EU SCCs as modified by this Section will be known as the “Swiss SCCs”.

9.4 Transfers from the UK

Where a Restricted Transfer is made from the United Kingdom, the UK Transfer Addendum is incorporated into this DPA by reference and applies to the transfer.

9.5 General

Mercury may neither participate in, nor permit any Subprocessor to participate in, any onward Restricted Transfer unless the further Restricted Transfer is made in compliance with Data Protection Laws and in accordance with applicable Standard Contractual Clauses or an alternative legally compliant transfer mechanism.

10. Termination

10.1 Termination

This DPA terminates automatically upon termination or expiration of the Payroll Agreement. This DPA may not be terminated independently of the Payroll Agreement. A material breach of this DPA by Mercury constitutes a material breach of the Payroll Agreement for the purposes of the Payroll Agreement’s termination provisions.

10.2 Return or Deletion of Payroll Personal Data

Following termination of this DPA, Mercury will make Payroll Personal Data available for export for 90 days. After that period, Mercury may delete any and all remaining Payroll Personal Data from its systems, unless the law requires us to keep it.

11. Liability & Indemnification

11.1 Limitation of Liability

Each party’s liability arising from this DPA is subject to the limitations and exclusions set forth in the Payroll Agreement.

11.2 Mutual Indemnification

Each party will defend, indemnify, and hold harmless the other party, its officers, directors, employees, and affiliates, from and against any third-party claims, losses, liabilities, damages, costs, and expenses, including reasonable attorneys’ fees, arising from the indemnifying party’s material breach of this DPA or violation of Data Protection Laws related to its obligations under this DPA, subject to the limitation of liability in the Payroll Agreement. The Indemnification Procedure set forth in Section 17.3 of the Payroll Agreement governs any Claim under this Section 11.

12. General

12.1 Governing Law and Jurisdiction

This DPA will be governed by and interpreted in accordance with the governing law and jurisdiction provisions in the Payroll Agreement.

12.2 Conflict

If of a conflict or inconsistency between the Payroll Agreement, this DPA, and the Standard Contractual Clauses, the terms of the following documents will prevail (in order of precedence) with regard to the Processing of Payroll Personal Data: the Standard Contractual Clauses (as applicable); then this DPA; and then the Payroll Agreement.

13. Definitions

Capitalized terms not defined in this Section 13 have the meanings assigned to them in the Payroll Agreement or Data Protection Laws.

“Payroll Personal Data” means Payroll Data, as defined in the Payroll Agreement, that constitutes Personal Information and that Mercury Processes on your behalf to provide the Services. Payroll Personal Data does not include: (i) Personal Information described in Section 1.5, Excluded Processing; or (ii) data that has been de-identified, aggregated, or anonymized such that it no longer identifies or is reasonably linkable to any individual or to you, which Mercury may use for any lawful purpose.

“Data Subject” means a natural person that is identified by or identifiable from Payroll Personal Data.

“Data Protection Laws” means all applicable laws, rules, regulations, and guidance related to privacy, data protection, or cybersecurity, including but not limited to: (i) the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA”); (ii) the Virginia Consumer Data Protection Act (Va. Code §§ 59.1-575 et seq.) (“VCDPA”); (iii) the General Data Protection Regulation (Regulation (EU) 2016/679) (“EU GDPR”); (iv) the Swiss Federal Act on Data Protection; (v) the EU GDPR as it forms part of the law of England and Wales by virtue of section 3 of the European Union (Withdrawal) Act 2018 (the “UK GDPR”) (together with the EU GDPR, the “GDPR”); (vi) the UK Data Protection Act 2018; and (vii) the Privacy and Electronic Communications (EC Directive) Regulations 2003; and any other applicable federal, state, or international laws, rules, regulations, and guidance related to privacy and data protection, in each case, as updated, amended or replaced from time to time.

“EU SCCs” means the Standard Contractual Clauses approved by the European Commission in Commission Decision 2021/914 dated 4 June 2021, for transfers of personal data to countries not otherwise recognized as offering an adequate level of protection for personal data by the European Commission (as amended and updated from time to time), as modified by Section 9.2 (Transfers from the EEA) of this DPA.

“Personal Information” means information that constitutes “personal data,” “personal information,” “personally identifiable information,” or any analogous terms, as defined under applicable Data Protection Law.

“Process,” “Processed,” “Processing,” and related terms mean any operation performed on data, including the collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction of the data.

“Restricted Transfer” means any transfer of Payroll Personal Data from one jurisdiction to another that is subject to restrictions under any applicable Data Protection Laws. “Security Incident” means a breach of security leading to the unauthorized acquisition of, access to, disclosure of or loss of Payroll Personal Data in Mercury’s possession or control that compromises the confidentiality, integrity, or availability of such Payroll Personal Data in a manner that creates a material risk of harm to the affected Data Subjects.

“Security Measures” means the security measures attached to this DPA as Appendix 2.

“Services” means the Mercury Payroll services that Mercury is providing to you under the Payroll Agreement or applicable Order Form(s).

“Standard Contractual Clauses” or “SCCs” mean the EU SCCs, Swiss SCCs, and EU SCCs as amended by the UK Transfer Addendum.

“Subprocessor” means any organization or third party engaged by Mercury to Process Payroll Personal Data in the course of providing the Services.

“UK Transfer Addendum” means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, published by the UK Information Commissioner’s Office on March 21, 2022, which is completed with the information as set forth in this DPA.

Appendix 1 — Details Regarding the Processing

1. List of Parties

Data exporter(s)

• Identity and contact details: The data exporter is the entity identified as “you” or “your” in the DPA. The address and relevant contact person for you are as set forth in the Payroll Agreement or as otherwise provided at the time of contracting.
• Activities relevant to the data transferred under these clauses: Performance of the Services under the Payroll Agreement and any applicable Order Form(s).
• Role: For transfers under Module 2 of the EU SCCs, you and/or your authorized affiliate is a Controller. For transfers under Module 3 of the EU SCCs, you and/or your authorized affiliate is a Processor.

Data importer(s)

• Identity and contact details: The data importer is Mercury Technologies, Inc. The address for Mercury is as set forth in the applicable Order Form(s). Contact information: help@mercury.com.
• Activities relevant to the data transferred under these clauses: Performance of the Services under the Payroll Agreement and any applicable Order Form(s).
• Role: Processor.

2. Description of the Transfer and Processing

Categories of Data Subjects: Current and former employees (including W-2 employees) of yours; contractors and other individuals engaged by you to perform services and paid through the Services; dependents, beneficiaries, and other individuals designated by employees or contractors for benefits, tax, or payment purposes; individuals nominated to complete verification or authentication tasks on behalf of employees or contractors (such as I-9 verifiers); authorized users of the Services acting on your behalf; and any other individual whose Payroll Personal Data is received by Mercury through a third-party integration with the Services that you have enabled or from a user related to their use of the Services.

Categories of Payroll Personal Data: You determine and control the extent and types of Payroll Personal Data you submit to the Services or that is collected by Mercury or its Subprocessors at your direction. Depending on the nature of the Services used, Payroll Personal Data may include: contact information; employment and compensation data; government identifiers; financial and tax information; payment instructions and transaction information; demographic information; benefits enrollment data; employment eligibility verification information; log and device data; and other data associated with use of the Services.

Sensitive Data Transferred: Government-issued identification numbers; financial account information; immigration and citizenship status information; demographic data revealing racial or ethnic origin, and information indicating sex assigned at birth; and, where applicable to the Services, health-related information (e.g., health insurance benefits and claims information).

Frequency of the Processing: Continuous basis depending on use of the Services by you.

Nature and Purpose of the Processing: Processing necessary to provide the Services described in the Payroll Agreement or applicable Order Form(s), including to: set up, operate, maintain, and support the Mercury Payroll platform and Services; process payroll and related payments; calculate and administer tax withholdings, benefits contributions, and other deductions; support employment eligibility verification workflows; administer benefits enrollment; help ensure security and integrity; prevent and investigate security or fraud issues; verify or maintain the quality and safety of Payroll Personal Data; develop and improve service features and functionalities; and comply with any legal and regulatory obligations.

Duration of the Processing: Subject to Section 10 (Termination), for the duration of the Payroll Agreement, plus any applicable legal retention period.

Appendix 2 — Security Measures

Mercury implements the following technical and organizational measures to protect Payroll Personal Data:

• Organizational Measures
  • Information Security Program. Mercury maintains a written information security program designed to protect the confidentiality, integrity, and availability of Payroll Personal Data.
  • Personnel. Mercury ensures that personnel authorized to Process Payroll Personal Data are subject to appropriate confidentiality obligations. Mercury provides security awareness training to personnel with access to Payroll Personal Data.
  • Incident Response. Mercury maintains an incident response plan designed to enable timely identification, investigation, containment, and remediation of Security Incidents.
  • Vendor Management. Mercury maintains a process for evaluating the security practices of Subprocessors before engagement and on an ongoing basis as commercially reasonable.
• ** Technical Measures**
  • Access Controls
    • Multi-factor authentication (MFA) required for all user accounts.
    • Role-based access control (RBAC) limiting access based on the principle of least privilege, including restricted access to sensitive Payroll Personal Data categories (such as I-9 supporting documents and health-related information).
    • Unique user credentials for all personnel (no shared accounts).
    • Automatic session timeout after a period of inactivity consistent with Mercury’s security policies.
    • Regular access reviews to remove unnecessary access.
    • Access logging for sensitive Payroll Personal Data categories to support audit and compliance review.
• Encryption
  • In Transit. Mercury encrypts Payroll Personal Data in transit over public networks using industry-standard transport encryption protocols.
  • At Rest. Mercury encrypts Payroll Personal Data at rest using industry-standard encryption algorithms.
• Network and Infrastructure Security
  • Network controls, including firewalls and network segmentation, designed to protect from unauthorized access.
    • Monitoring. Mercury maintains logging and monitoring capabilities designed to detect unauthorized access.
    • Vulnerability Management. Mercury maintains a vulnerability management process designed to identify, evaluate, and remediate security vulnerabilities.
    • Penetration Testing. Mercury engages qualified third parties to conduct penetration testing of systems used to Process Payroll Personal Data on a periodic basis.
• Application Security
  • Secure Development. Mercury maintains secure software development practices designed to identify and remediate security vulnerabilities before deployment.
• Data Protection
  • Segregation. Mercury implements logical controls designed to segregate your Payroll Personal Data from the data of other customers.
  • Backup and Recovery. Mercury maintains backup procedures designed to support the availability and recoverability of Payroll Personal Data. Backups are protected by security controls consistent with those applied to production data.
  • Secure Disposal. Mercury implements procedures for the secure deletion or destruction of Payroll Personal Data and media containing Payroll Personal Data when no longer required, in accordance with this DPA.
• Physical Security. To the extent Mercury controls the physical facilities in which Payroll Personal Data is Processed, Mercury implements physical access controls designed to restrict access to authorized personnel. Where Mercury uses third-party data center providers, Mercury relies on the physical security controls maintained by such providers.
• Business Continuity. Mercury maintains business continuity and disaster recovery plans designed to support the availability and resilience of systems used to Process Payroll Personal Data.

Mercury may update these measures from time to time, provided that any such update does not materially diminish the overall level of protection afforded to Payroll Personal Data.

Appendix 3 — Other Jurisdictions

The provisions below apply if you have Data subjection in these locations.

Canada

Mercury will provide a level of protection for Payroll Personal Data originating in Canada that is comparable to the protection such information would receive under PIPEDA. Mercury will impose equivalent obligations on its Subprocessors. Upon request, Mercury will provide information about the jurisdictions in which Payroll Personal Data originating in Canada is Processed. Where a Security Incident involves Payroll Personal Data in Canada, Mercury’s notification will include sufficient information to enable you to assess whether the incident creates a “real risk of significant harm” triggering mandatory reporting to the Office of the Privacy Commissioner of Canada.

Quebec, Canada

Upon request, Mercury will provide you with the following information to enable you to conduct a privacy impact assessment: (i) the jurisdictions in which Payroll Personal Data is Processed; (ii) a description of applicable security measures; (iii) the identity and location of Subprocessors; and (iv) information regarding the legal framework in the destination jurisdiction.

Payroll Personal Data originating in Quebec will be deleted upon expiry or termination of the Payroll Agreement, as required by the Quebec Privacy Law, subject to any retention required by applicable law or by a Subprocessor’s own retention obligations, as described in Section 10 (Termination).

Mercury will notify your designated person in charge of the protection of Payroll Personal Data without delay of any violation or attempted violation of any confidentiality obligation concerning Payroll Personal Data originating in Quebec.

Brazil

To the extent legally required for transfers of Payroll Personal Data from Brazil, the parties agree to the Standard Contractual Clauses approved by Resolution CD/ANPD No. 19/2024 (“Brazilian SCCs”), which are incorporated into this DPA by reference and completed as follows:

• The parties will be Exporter (You) and Importer (Mercury), with details per Appendix 1.
• For Controller-to-Processor transfers, the parties select Option A. For Processor-to-Subprocessor transfers, the parties select Option B.
• Schedule III of the Brazilian SCCs is completed with the information in Appendix 2 (Security Measures) of this DPA.

Other Jurisdictions

Where Payroll Personal Data originates from a jurisdiction not otherwise addressed in this Appendix 3 (including but not limited to India, Australia, Singapore, Japan, South Korea, Mexico, Argentina, Chile, and other countries with data protection frameworks), Mercury will process such Payroll Personal Data consistent with the requirements applicable to processors, data intermediaries, or equivalent roles under the applicable Data Protection Laws of such jurisdiction, as applicable. Where a specific data transfer mechanism or cross-border restriction is required by applicable law, the parties will in good faith execute such additional documentation as may be reasonably required.