Global Data Processing Agreement

Last Updated: 21 October 2026

This Global Data Processing Agreement (“DPA”) is effective as of the effective date of the Principal Agreement into which it is incorporated (or, where executed by signature rather than incorporated by reference, the date on which it is signed) and is between QVC Group, Inc. (“QVC”), and the entity identified in, or determined by reference to, the Principal Agreement as "Vendor". Intending to be legally bound hereby, QVC and Vendor agree as follows: Where this DPA is incorporated by reference into a Principal Agreement, entry into the Principal Agreement constitutes execution of this DPA and, if and to the extent applicable, the EU Standard Contractual Clauses, the UK Addendum and the BAA, with each applicable QVC Group Company (as listed in the Schedule (QVC Group Companies) and each executing as data exporter and Vendor executing as data importer for the purposes of the EU Standard Contractual Clauses and the UK Addendum), effective as of the effective date of the Principal Agreement.

1. DEFINITIONS. In this DPA:

   “Alternative Transfer Solution” means a solution approved by QVC Group Companies, other than EU Standard Contractual Clauses and UK Addendum, that enables the lawful transfer of personal data to a Relevant Country in accordance with Data Protection Laws.

   “BAA” means the Business Associate Agreement available at this link: https://corporate.qvc.com/lp/business-associate-agreement

   "Data Processing Exhibit" means the Data Processing Exhibit attached to this DPA, which sets out standard default terms describing Vendor's Processing activities, together with any data processing exhibit, schedule, appendix or dedicated section incorporated into or forming part of the applicable Principal Agreement that sets out more specific details of the Processing. Where the parties have agreed more specific Processing details in the applicable Principal Agreement, those details shall prevail over the standard default terms of the attached Data Processing Exhibit to the extent of any conflict; where no such details are agreed, the standard default terms of the attached Data Processing Exhibit apply.

   “Data Protection Law” means any present or future applicable laws and regulations relating to data privacy, data security, or the use or processing of Personal Data, including without limitation: (a) Privacy and Electronic Communications Directive 2002/58/EC on Privacy and Electronic Communications (together with any related laws adopted by any EEA member states and together with any related regulations, "ePrivacy Directive"); (b) EU Regulation 2016/679 (together with any related laws adopted by any EEA member states and together with any related regulations, “GDPR“); (c) the UK Privacy and Electronic Communications Regulations 2003; (d) EU Regulation 2016/679 as it forms part of the law of the United Kingdom (as defined in section 3 of the UK Data Protection Act 2018) (“UK GDPR“); (e) the UK Data Protection Act 2018 (“UK DPA”); (f) Japan’s Act on the Protection of Personal Information (together with any related regulations, “APPI”); (g) California Consumer Privacy Act of 2018 (together with any related regulations, "CCPA"); (h) laws and regulations which the QVC Group Companies are obliged to impose on Vendor, including without limitation the Massachusetts data security regulations (201 Mass. Code Regs. §§ 17.01 – 17.05) and the New York Stop Hacks and Improve Electronic Data Security Act (SHIELD Act); (i) any laws or regulations ratifying, implementing, adopting, supplementing or replacing any of the foregoing; and (j) any amendments, updates, or replacements to any of the foregoing.

   “Data Regulator” means any local, state, national or multinational agency, department, official, parliament, public or statutory person or any government or professional body, regulatory or supervisory authority, board or other body responsible for administering the Data Protection Laws, including without limitation any "Supervisory Authority" as defined in GDPR or UK GDPR.

   “Data Subject” means any person to whom Personal Data relates. "Data Subject" includes without limitation "data subject", as defined in Data Protection Law.

   “EEA” means the European Economic Area.

   "Incorporated Agreement" means any agreement that is incorporated into this DPA.

   "Permitted Sub-Processors” means the sub-processors authorized by QVC pursuant to Section 3.1.

   “Personal Data“ means information provided to or Processed by Vendor by or on behalf of any QVC Group Company that identifies, relates to, describes, is capable of being associated with, or could be linked to, directly or indirectly, a natural person. "Personal Data" includes without limitation information provided to Vendor by or on behalf of any QVC Group Company if such information is regulated under Data Protection Law.

   "Principal Agreement" means any purchase order, statement of work or other contract that incorporates this DPA.

   “Processing” means any creation, access, modification, disclosure, transfer, storage, deletion, destruction, or other use of Personal Data; "Processing" includes without limitation "processing", as defined in Data Protection Laws. “Process" and “Processed” shall be construed accordingly.

   "QVC Group Companies” In this DPA, “QVC Group Company” means QVC or any Affiliate. "Affiliate" means any present or future entity that directly or indirectly controls, is controlled by, or is under common control with QVC. For purposes of the preceding sentence, "control", "controlled", and "controls" with respect to an entity means (a) direct or indirect ownership of at least 35% of such entity’s capital stock or other voting interests or (b) the ability to direct the senior management of such entity.

   “Relevant Country” means all countries other than those within the European Union or EEA and countries in respect of which an adequacy finding under Article 25(6) of the European Data Protection Directive 95/46/EC on the protection of individuals with regard to the processing of personal data and on the free movement of such data (“European Data Protection Directive”), or Article 45 of the GDPR, or UK GDPR/ UK DPA, has been given.

   “Security Breach” means with respect to Personal Data (1) a "Personal Data Breach" as defined in GDPR and UK GDPR; (2) a breach of security or other breach of Personal Data under any other Data Protection Law; or (3) any other unauthorized access, unauthorized acquisition, unauthorized destruction, unauthorized deletion, unauthorized disclosure, unauthorized use, unauthorized modification, loss, or misappropriation of Personal Data or other compromise of the security, confidentiality, integrity, or availability of Personal Data.

   "Security Controls" means the technical and organizational measures for securing Personal Data set out in the Security Controls (also referred to as the "TOMs") published by QVC at https://corporate.qvc.com/lp/vendor-security-controls/ (as updated from time to time), which are incorporated into this DPA by reference.

   “Services” means goods, services, technology or other products provided by Vendor to QVC Group Companies under any Principal Agreement, and any evaluation by the QVC Group Companies of Vendor's goods, services, technology or other products.

   “EU Standard Contractual Clauses” means the Standard Contractual Clauses set out in the European Commission’s Implementing Decision (EU) 2021/914 of 4 June 2021 (as may be amended, updated or superseded from time to time), as set out at this link: https://corporate.qvc.com/lp/standard-contractual-clauses which are incorporated into this DPA by reference.

   “UK Addendum” means the Addendum issued by the UK Information Commissioner's Office in accordance with the Data Protection Act 2018 on 2 February 2022 (as may be amended, updated or superseded from time to time by the UK Government or the Information Commissioner's Office) and as currently set out at this link: https://corporate.qvc.com/lp/uk-addendum, which is incorporated into this DPA by reference.

2. PROCESSING OF PERSONAL DATA
   1. Personal Data is confidential information of the QVC Group Companies. Vendor shall (a) Process Personal Data for the exclusive benefit of the QVC Group Companies and solely for the business purpose of providing the Services to the QVC Group Companies under the Principal Agreements and on other documented instructions of the QVC Group Companies; (b) not retain, use, disclose or otherwise Process Personal Data for any purpose except as set forth in the preceding clause (a); (c) Process Personal Data in compliance with Data Protection Law; and (d) not sell or share (as those terms are defined under Data Protection Law) Personal Data. Vendor shall immediately inform the relevant QVC Group Company if, in Vendor’s opinion, an instruction infringes Data Protection Law. A list of Vendor's Processing activities is included in the Data Processing Exhibit, and Vendor and QVC may include additional Processing activities under this DPA by agreeing more specific Processing details in the applicable Principal Agreement (including any data processing exhibit, schedule, appendix or order form forming part of it), which shall prevail over the standard default terms of the Data Processing Exhibit to the extent of any conflict. Where no such details are agreed, the standard default terms of the Data Processing Exhibit apply. With respect to CCPA, each QVC Group Company is a “business” (as defined in CCPA) and is engaging Vendor as a “service provider” (as defined in CCPA) to Process Personal Data in the performance of the Services on behalf of the QVC Group Companies. With respect to GDPR and UK GDPR, each QVC Group Company is a "controller" (as defined in GDPR and UK GDPR) and Vendor is a "processor" (as defined in GDPR and UK GDPR). Without limiting the previous part of this Section 2.1, Vendor shall not use Personal Data for marketing, advertising, modeling, training (including without limitation training of LLM or other AI related models), analytics or any other secondary use.
   2. Except as set forth in Section 2.3, Vendor shall not disclose Personal Data to any person or entity except Permitted Recipients (as defined below) and shall not permit Personal Data to be Processed by any person or entity except Permitted Recipients. “Permitted Recipients” are Vendor's current employees and Permitted Sub-Processors and their employees who both (a) have a need to know Personal Data to provide the Services; and (b)(i) have agreed in writing to Process and maintain the confidentiality of Personal Data pursuant to obligations which are at least as restrictive and protective of Personal Data as Vendor's obligations to QVC under this DPA; and (ii) with respect to Permitted Sub-Processors, comply with Section 3.1 and Section 3.2 of this DPA. Vendor agrees (1) to cause each Permitted Recipient to comply with this DPA to the same extent that Vendor is obligated to comply with this DPA; (2) that with respect to Personal Data, any action or failure to take action by a Permitted Recipient shall be deemed to be Vendor's action or failure to take action
   3. Subject to the next sentence, if Vendor is required by applicable law to disclose Personal Data to any person other than Permitted Recipients, then Vendor shall (a) before making such disclosure, notify QVC of such impending disclosure; (b) cooperate with QVC to enable QVC to obtain a protective order or other similar order with respect to disclosure of Personal Data; and (c) disclose only the minimum of Personal Data that is required to be disclosed in order to comply with applicable laws, whether or not a protective order or other order has been obtained. If Vendor is prohibited by applicable law from complying with the previous sentence and Vendor does disclose Personal Data other than to a Permitted Recipient, then Vendor shall notify QVC in writing of the details of such disclosure within 30 days after Vendor is no longer prohibited by applicable law from making such disclosure to QVC.
   4. Within 30 days after QVC's request, Vendor shall identify to QVC the person responsible at Vendor for handling Personal Data.
   5. Where Vendor is located in a Relevant Country, Personal Data subject to GDPR / UK GDPR is not transferred to the Vendor, unless an appropriate transfer mechanism under Data Protection Laws that permit such transfer is in place, including EU Standard Contractual Clauses and UK Addendum (as applicable) and adequate additional or supplementary measures as required by Data Protection Laws are duly and timely implemented.
      1. Transfers of Personal Data subject to GDPR / UK GDPR between QVC Group Companies and Vendor shall, subject to the order of precedence in this Section 2.5.1, be governed by EU Standard Contractual Clauses and UK Addendum (as applicable) incorporated in the DPA. In the event that more than one transfer mechanism may apply, transfer of EU / UK Personal Data to the Vendor will be subject to the appropriate single transfer mechanism in accordance with the following order of precedence: (i) The Alternative Transfer Solution; (ii) EU Standard Contractual Clauses (Module Two Controller to Processor) and UK Addendum; or (iii) if neither (i) nor (ii) is applicable, another transfer mechanism as QVC approves in writing that complies with applicable Data Protection Laws. Within 30 days after QVC Group's request generally or within 2 days after QVC Group's request following a Security Breach, Vendor shall identify to QVC the locations of Personal Data. For the avoidance of doubt, where a QVC Group Company not established in the EU acts as data exporter, the EU Standard Contractual Clauses apply using the options for an exporter not established in the Union or Member State specified in the SCCs. If and to the extent required under Data Protection Laws, when EU/ UK Personal Data is transferred into the EEA and/or where the importer's processing is itself subject to the GDPR, EU Standard Contractual Clauses will apply.
      2. If EU Standard Contractual Clauses / UK Addendum apply, then Annex I to such EU Standard Contractual Clauses and Part 1: Table 3 - Annex 1A and 1B to such UK Addendum shall be deemed to be the same as the applicable Data Processing Exhibit, and Part 1: Table 1 (Parties) to such UK Addendum shall be deemed completed by reference to the Schedule (QVC Group Companies) and the Principal Agreement.
      3. If EU Standard Contractual Clauses / UK Addendum apply, then Annex II to such EU Standard Contractual Clauses shall be deemed to be completed by referencing Security Controls and Section 5 of this DPA and Part 1: Table 3 - Annex II to such UK Addendum shall be deemed to be completed by referencing Security Controls and Section 5 of this DPA.
      4. If EU Standard Contractual Clauses / UK Addendum apply, then Annex III to the EU Standard Contractual Clauses and Part 1: Table 3 - Annex III of the UK Addendum shall be deemed to be completed by referencing the list of Permitted Sub-Processors in the Data Processing Exhibit.
      5. Where Vendor transfers Personal Data to a Permitted Sub-Processor located in a Relevant Country, Vendor shall implement a transfer mechanism compliant with applicable Data Protection Law (including the applicable Module of the EU Standard Contractual Clauses and/or the UK Addendum) together with any additional or supplementary measures required by Data Protection Law, and shall provide, at QVC’s request, evidence of the transfer mechanism implemented (including a copy of the EU Standard Contractual Clauses / UK Addendum, where executed).
3. SUB-PROCESSING OF PERSONAL DATA
   1. QVC hereby authorizes Vendor to engage (a) the entities listed in the Data Processing Exhibit as Permitted Sub-Processors to Process Personal Data in compliance with this DPA; and (b) any additional entity ("Proposed Sub-Processor") retained by Vendor to Process Personal Data in compliance with this DPA so long as: (1) Vendor provides QVC with written notice 15 days before permitting the Proposed Sub-Processor to Process Personal Data, (2) QVC does not object to the Proposed Sub-Processor within 15 days after receiving the notice under preceding Section 3.1(b)(1), and (3) Vendor complies with this DPA with respect to such Proposed Sub-Processor. If QVC Group objects to a Proposed Sub-Processor within that period, Vendor and QVC will work together in good faith to resolve the objection; if it cannot be resolved, QVC may terminate the portion of the Services for which Vendor is retaining the Proposed Sub-Processor.
   2. Vendor shall impose on each Permitted Sub-Processor, by way of contract, data protection obligations no less restrictive than those set out in this DPA and that comply with GDPR / UK GDPR and that obligate the Permitted Sub-Processor to Process and maintain the confidentiality of Personal Data pursuant to obligations which are at least as restrictive and protective of Personal Data as Vendor’s obligations to the QVC Group Companies under this DPA.
4. DATA SUBJECT RIGHTS
   1. As part of the Services, Vendor shall assist the QVC Group Companies promptly (and, in any event, within any timeframe required by Data Protection Law) in responding to, and fulfilling, requests from Data Subjects to exercise rights provided to Data Subjects under Data Protection Law (such rights, "Data Subject Rights"). Such assistance shall include, without limitation (a) deleting Personal Data; (b) providing access to Personal Data; (c) providing a copy of Personal Data; (d) correcting Personal Data; (e) restricting Processing of Personal Data; (f) providing Personal Data in a portable format; and (g) terminating any sales of Personal Data. Vendor shall provide in writing the Vendor's procedure for enabling the fulfillment of exercises of Data Subject Rights. QVC Group Companies may provide notices of exercises of Data Subject Rights to Vendor's email address identified in accordance with the Data Processing Exhibit.
5. SECURITY; SECURITY BREACHES
   1. With respect to Personal Data, Vendor shall implement, maintain, and document in a written information security plan physical, administrative, technical and organizational measures that comply with Data Protection Law and that are appropriate to both the nature of the Personal Data being Processed by Vendor and any risks associated with such Processing and that are no less protective than the Security Controls (such measures, the "Vendor Security Program"), and the Vendor Security Program shall (a) protect against unauthorized access, unauthorized acquisition, unauthorized destruction, unauthorized deletion, unauthorized disclosure, unauthorized use, unauthorized modification, loss, or misappropriation of Personal Data or other compromise of the security, confidentiality, integrity, or availability of Personal Data; (b) ensure that Personal Data is logically isolated and separated from other information or databases stored, handled or Processed by Vendor for itself or third parties; (c) ensure that copies of Personal Data are not made except to the extent necessary to provide the Services to the QVC Group Companies; (d) ensure that Permitted Recipients are (i) provided access to the minimum amount of Personal Data that is needed to perform the Services; (ii) trained on an appropriate recurring schedule in applicable personal data security and privacy safeguards and Data Protection Law; and (iii) disciplined by Vendor through appropriate measures for violations of such safeguards.
   2. Vendor shall: (a) promptly investigate each Security Breach; and (b) take all reasonable steps to prevent, limit, stop or otherwise remedy any Security Breach, which may include development and execution of a written plan to reduce the likelihood of a Security Breach.
   3. Vendor shall notify QVC in writing of a Security Breach promptly and without undue delay, but in any event within 48 hours, after Vendor first becomes aware of a Security Breach. Such notification shall include, at a minimum: (a) a description of the nature of the Security Breach, the categories and numbers of Data Subjects affected, and the categories and numbers of Personal Data records affected; (b) identification of the name and contact details of the data protection officer or other person at Vendor and relevant Permitted Recipient(s) from whom additional information can be obtained; (c) a description of the likely consequences of the Security Breach; and (d) a description of the measures taken or proposed to be taken to address the Security Breach. Where, and in so far as, it is not possible to provide all information at the same time, the initial notification shall contain the information then available and further information shall, as it becomes available, subsequently be provided without undue delay. Following the initial notification described in this Section 5.3, Vendor shall promptly provide QVC with any further information regarding the Security Breach that: (i) results from Vendor's response to the Security Breach; (ii) is necessary to enable QVC Group Companies to meet the notification obligations and other obligations of QVC Group Companies under Data Protection Law; or (iii) is relevant to enable QVC Group Companies to fully understand and assess the Security Breach's cause and effects.
   4. Vendor shall (a) cooperate with and assist QVC Group Companies, their agents, and Data Regulators in connection with any investigation, response and other activities that QVC Group Companies or Data Regulators may wish to conduct with respect to such Security Breach; and (b) provide QVC Group Companies and Data Regulators with information requested by QVC Group Companies or Data Regulators in connection with the Security Breach.
   5. Except to the extent required by law, Vendor shall not make any notification of a Security Breach without QVC's prior written approval to either any Data Subject whose Personal Data may have been, or may be, affected by a Security Breach or to any third party other than to law enforcement, to Vendor's Security Breach response service providers, and to other entities affected by the Security Breach, and to the limited extent as necessary to comply with applicable laws.
6. DATA PROTECTION IMPACT ASSESSMENT AND PRIOR CONSULTATION
   1. As part of the Services, Vendor shall provide reasonable assistance to QVC Group Companies with any data protection impact assessments, and prior consultations with a Data Regulator or other competent authorities, which QVC Group Companies reasonably consider to be required by Articles 35 and 36 of the GDPR or by equivalent provisions of any other Data Protection Law, taking into account the nature of the Processing and information available to Vendor.
7. DELETION OR RETURN OF PERSONAL DATA
   1. Vendor's General Obligation to Delete Personal Data. Vendor shall destroy and delete, and procure the destruction and deletion of, all Personal Data within 30 days after the termination or expiration of Services for which Vendor is Processing Personal Data, except to the extent prohibited by applicable law. Vendor shall certify in writing to any requesting QVC Group Company that Vendor has complied with its obligations under this Section 7.1 within 45 days after receipt of QVC’s request for such certification, and in such certification, Vendor shall disclose and describe any applicable laws under which Vendor is retaining Personal Data.
   2. Vendor's Obligation to Delete Personal Data at QVC Group Company Request. A QVC Group Company may in its absolute discretion by written notice to Vendor at any time require Vendor to, and Vendor shall (a) delete and procure the deletion of all such QVC Group Company's Personal Data; and (b) within 45 days after the date of the QVC Group Company's notice under this Section 7.2, certify in writing to the QVC Group Company that Vendor has deleted and procured the deletion of all Personal Data as required by this Section 7.2, and in such certification, Vendor shall disclose and list any applicable laws under which Vendor is retaining Personal Data.
   3. Vendor's Obligation to Return Personal Data at QVC Group Company Request. A QVC Group Company may in its absolute discretion by written notice to Vendor at any time require Vendor to, and Vendor shall (a) return a complete copy of all such QVC Group Company's Personal Data to such QVC Group Company by secure file transfer in such format as is reasonably specified by the QVC Group Company; and (b) within 60 days after the date of the QVC Group Company's notice under this Section 7.3, certify in writing to the QVC Group Company that Vendor has returned a complete copy of all Personal Data as required by this Section 7.3.
8. INFORMATION; AUDITS
   1. Vendor shall provide QVC with such information as QVC reasonably request from time to time with respect to Vendor's compliance with Vendor's obligations under this DPA including, without limitation, if available and disclosable, the results of any audits or tests performed on Vendor's information systems or security controls or on any components thereof. Vendor will notify QVC promptly, but in any event within 30 days, after Vendor is first aware of any material finding, material weakness, or other similar finding resulting from an examination or audit of Vendor's privacy, security, or confidentiality controls, and such examinations or audits include without limitation, any SSAE SOC2, ISAE 3402, ISO 27001, or payment card industry data security standards validation or examination.
   2. Vendor shall, with respect to Personal Data it collects from QVC Companies, cooperate with and assist QVC in: (i) completing QVC’s cybersecurity audit pursuant to Article 9 CCPA, including making available all relevant information Vendor’s possession, custody, or control, and not misrepresenting any fact that QVC (or any appointed auditor) deems relevant to complete cybersecurity audit; (ii) conducting the risk assessment pursuant to Article 10 of the CCPA, including making available to QVC all facts necessary to conduct the risk assessment that are in Vendor’s possession, custody, or control, and not misrepresenting any fact necessary to conduct the risk assessment; and (iii) complying with the QVC’s ADMT requirements pursuant to Article 11 of the CCPA.
   3. Vendor shall permit QVC, their agents and any Data Regulator to conduct an Audit. "Audit" means an audit and inspection of Vendor's systems, records, procedures, privacy controls, confidentiality controls, and security controls upon reasonable advance written notice and during regular business hours, physically or virtually, as agreed by both parties, at Vendor's offices and at locations where Personal Data is Processed to verify Vendor's compliance with this DPA and Data Protection Law. Subject to the next sentence, QVC may conduct an Audit only once per calendar year, and QVC Group Companies shall coordinate their Audit through one lead QVC Group Company. If a Security Breach occurs, QVC may conduct an Audit, and QVC Group Companies shall coordinate such Audit through one lead QVC Group Company. Vendor will reasonably cooperate with and provide information to QVC Group Companies and Data Regulators in connection with an Audit. For the avoidance of doubt and notwithstanding the foregoing, QVC may conduct, and Vendor shall cooperate with, a review of Vendor's controls at any time if the scope of the Principal Agreement or Personal Data changes.
9. GENERAL TERMS
   1. Incorporation. This DPA: (a) is incorporated into the Principal Agreements; (b) together with any exhibits, schedules or other attachments hereto is the complete agreement of the parties concerning the subject matter hereof and supersedes any prior such agreements with respect to Personal Data Processed under the applicable Principal Agreement, unless that Principal Agreement expressly provides otherwise; provided that, where QVC (or a QVC Group Company or the Plan) and Vendor have separately executed a bilateral written BAA, that separately executed BAA prevails to the extent of any conflict; (c) may not be amended or in any manner modified except (i) in writing signed by the parties; or (ii) by QVC in accordance with Section 9.7; and (d) shall, except as provided in Section 9.8 (and in the BAA) with respect to the BAA, be governed by and construed in accordance with the laws of the jurisdiction specified in the Principal Agreement without regard to its choice of law provisions and the parties shall be subject to the exclusive jurisdiction of, and exclusive venue in, the courts specified in the Principal Agreement. If any provision of this DPA is found by a court to be unenforceable, the remainder shall be enforced as fully as possible and the unenforceable provision shall be deemed modified to the limited extent required to permit its enforcement in a manner most closely approximating the intention of the parties as expressed herein.
   2. Conflicts. If this DPA conflicts with any other agreement between Vendor and any QVC Group Company (a "Conflicting Agreement"), then, subject to Section 9.3, this DPA shall control to the extent of such conflict, and the conflicting provision of the Conflicting Agreement shall be disregarded to the extent of such conflict.
   3. Order of precedence. In the event of any conflict or inconsistency between this DPA, the Principal Agreement, the Data Processing Exhibit, the EU Standard Contractual Clauses, the UK Addendum, the BAA, the Security Controls, and any other document incorporated by reference into this DPA: (a) the BAA shall control with respect to Protected Health Information subject to HIPAA; (b) the EU Standard Contractual Clauses and the UK Addendum shall control with respect to restricted transfers of Personal Data to the extent required by applicable Data Protection Law; (c) this DPA shall control in all other respects; and (d) the Principal Agreement shall control only to the extent it does not conflict with the foregoing, provided that more specific Processing details agreed in the Principal Agreement shall prevail over the standard default terms of the Data Processing Exhibit as provided in Section 2.1.
   4. Notices. Any communication required or otherwise made under this DPA (“Notice”) shall be made to a party at its address as set out, in the case of QVC, in the Schedule (QVC Group Companies) to this DPA, and in the case of Vendor, in the Principal Agreement. Notice shall be made by either personal delivery, certified mail, or commercial overnight delivery, provided however that Notices by Vendor under Section 2.3 or Section 5.3 shall be made to privacynotice@qvc.com followed promptly by written confirmation to QVC's street address for Notice. A copy of any Notice by Vendor to QVC shall also be delivered to the attention of QVC’s General Counsel at QVC’s address. Notice made pursuant to this Section 9.4 shall be deemed to have been given when such Notice is received. A party may change its address for receipt of Notice pursuant to this Section 9.4.
   5. Duration. The duration of this DPA shall be the same as the duration of the Principal Agreement into which it is incorporated. Notwithstanding expiration or termination of this DPA or the Principal Agreement: (a) all rights and obligations hereunder with respect to Personal Data shall continue in effect; and (b) this DPA shall continue to be effective to the extent this DPA governs Personal Data under, or is incorporated by reference into, any other agreement between Vendor and any QVC Group Company.
   6. QVC Group Companies. A QVC Group Company becomes a party to this DPA, and to any Incorporated Agreement, in respect of a Principal Agreement by entering into, or being named in, that Principal Agreement (including by entry into a Principal Agreement that is published or accepted electronically), and upon doing so the QVC Group Company will be an additional party under this DPA. For the avoidance of doubt, the Personal Data of a QVC Group Company is subject to this DPA and each Incorporated Agreement, even if such QVC Group Company does not become a party to this DPA or any Incorporated Agreement under the preceding sentence. The QVC Group Companies (a) are not acting as joint controllers within the meaning of GDPR or UK GDPR but (b) will coordinate their activities directed at Vendor through QVC. Affiliates are third party beneficiaries of this DPA, except that this does not extend to the BAA (as applicable), which sets out its own third-party beneficiary provisions.
   7. Updates to this DPA. QVC may update this DPA from time to time. Updates to comply with or reflect applicable Data Protection Law or the guidance of a competent Data Regulator, and administrative amendments that do not materially increase Vendor's obligations beyond what such law or guidance requires, take effect on publication at the applicable URL without prior notice. Any other change that materially increases Vendor's obligations (a "material change") requires no less than 15 days' prior notice (which may be written, email or other electronic notice). If Vendor objects in writing before the effective date, the parties shall negotiate the affected provision(s) in good faith; if no agreement is reached, QVC may proceed and Vendor's sole remedy shall be to terminate the affected Principal Agreement(s) on written notice, without penalty. Absent timely written objection, Vendor is bound by the change. For the avoidance of doubt, this Section 9.7 does not authorize any change to the text of the EU Standard Contractual Clauses or the UK Addendum other than completing or updating the Appendix/Annex information and selecting the applicable Module(s). Any revision to the approved clause text, or to the format of the UK Addendum Part 1 Tables, will be made only as permitted by the Clauses and the Addendum (including Section 17 and Section 18 of the UK Addendum), which prevail over this Section 9.7 to that extent.
   8. Business Associate Agreement. If and to the extent Vendor will create, receive, maintain or transmit Protected Health Information for or on behalf of a group health plan sponsored by QVC (as further described in the BAA, the “Plan”) such that Vendor is a business associate of the Plan under HIPAA, (a) Vendor shall notify QVC before Vendor first creates, receives, maintains or transmits such Protected Health Information; and (b) the BAA is incorporated into this DPA by reference and is entered into by Vendor with effect from the effective date of the Principal Agreement, without the need for any separate document or signature, and Vendor’s entry into the Principal Agreement constitutes Vendor’s execution of the BAA. The record of Vendor’s entry into the Principal Agreement constitutes evidence of Vendor’s execution of the BAA. QVC, as plan sponsor acting on behalf of the Plan, is the party to the BAA with Vendor; where a QVC Group Company other than QVC enters into the Principal Agreement, it does so also on behalf of QVC and the Plan for the purposes of the BAA. The BAA is governed by the law, and subject to the forum, specified in the BAA. This DPA applies to such processing of Protected Health Information in addition to the BAA. If the BAA and this DPA conflict with respect to such processing of Protected Health Information, the BAA shall control. “HIPAA” and “Protected Health Information” have the meanings given in the BAA.
   9. Bulk Data Transfer Rule. This Section applies only to Personal Data of United States persons. Pursuant to 28 CFR Part 202, as may be amended (the “Bulk Data Transfer Rule”), implementing Executive Order 14117 (issued February 28, 2024) governing access to United States persons’ bulk sensitive personal data and government-related data, Vendor represents, warrants and covenants that: (a) Vendor shall not engage in any prohibited Covered Data Transaction, and shall engage in a restricted Covered Data Transaction only in compliance with the requirements of the Bulk Data Transfer Rule applicable to such transaction; (b) Vendor shall not grant, and shall ensure that no Covered Person or country of concern is granted, Access to Bulk U.S. Sensitive Personal Data or Government-related Data Processed under the Principal Agreement, except to the extent expressly permitted under, and in strict compliance with, the Bulk Data Transfer Rule; (c) if Vendor meets the definition of a Covered Person, or engages, contracts with or is affiliated with a Covered Person in a manner relevant to the Services, Vendor shall notify QVC within 2 days of becoming aware and shall, at QVC’s direction, cease the relevant Access to, use of, and other activities related to data obtained or accessed under the Principal Agreement; (d) if Vendor determines that any Covered Person or country of concern has obtained Access to Bulk U.S. Sensitive Personal Data or Government-related Data in a manner not permitted by the Bulk Data Transfer Rule, Vendor shall immediately terminate such Access and notify QVC Group within 2 days of discovery; and (e) Vendor complies with all requirements of the Bulk Data Transfer Rule applicable to it. Each capitalized term in this Section that is not defined in this DPA has the meaning set forth in the Bulk Data Transfer Rule.
   10. PCI. If and to the extent Vendor processes Credit Card data as regulated under Payment Card Industry Data Security Standard (“PCI DSS”), Vendor shall comply with the English language Payment Card Industry Data Security Standards in effect from time to time, as issued by the PCI Security Standards Council and with all applicable laws and regulations governing the collection, storage and use of PCI DSS Data furnished or made available by the relevant QVC Group Company to Vendor. “PCI DSS Data” means any Cardholder Data or Sensitive Authentication Data (as defined in the PCI DSS), as each term is used in the then-current English language Payment Card Industry Data Security Standards. PCI DSS Data is included in the definition of Personal Data. Where Vendor does not Process any PCI DSS Data, this Section 9.10 does not apply.

DATA PROCESSING EXHIBIT
(and, if applicable, Part 1, Table 3, Annex 1A and 1B to the UK Addendum and Annex I to the EU Standard Contractual Clauses respectively)

This Data Processing Exhibit (and, if applicable, Part 1, Table 3, Annex 1A and 1B to the UK Addendum and Annex I to the EU Standard Contractual Clauses respectively) is incorporated into the DPA to which this Exhibit is attached.

The names and contact details of QVC Group Companies which are data exporters under UK Addendum or EU Standard Contractual Clauses are set forth in the Schedule (QVC Group Companies) to this DPA or are otherwise determined by reference to the applicable Principal Agreement.

The details of the Processing taking place under this DPA are set out below.

EU Standard Contractual Clauses Annex I.A - List of Parties

1. Data exporter(s):
   • Name: as set forth in the Schedule (QVC Group Companies) to this DPA
   • Address: as set forth in the Schedule (QVC Group Companies) to this DPA
   • Contact person’s name, position and contact details: as set forth in the Schedule (QVC Group Companies) to this DPA, together with the data protection officer names
   • Activities relevant to the data transferred under these Clauses: Data exporters are part of a global group of companies that are affiliated with QVC Group, Inc. ("QVC"), a global group of retail companies. The QVC Group’s main focus is on the broadcast of teleshopping programs and on associated distribution channels, sales of products on websites, mobile platforms and other platforms, and related supporting services.
   • Signature and date: deemed executed and dated as the effective date of the Principal Agreement, as provided in this DPA
   • Role (controller/processor): Autonomous Controllers (not Joint Controllers)
2. Data importer(s):
   • Name: as set forth in, or determined by reference to, the Principal Agreement
   • Address: as set forth in, or determined by reference to, the Principal Agreement
   • Contact person’s name, position and contact details: as detailed in the Principal Agreement
   • Data Protection Officer's name, position and contact details: as detailed in the Principal Agreement
   • Activities relevant to the data transferred under these Clauses: as detailed in the Principal Agreement
   • Signature and date: deemed executed and dated as the effective date of the Principal Agreement, as provided in this DPA
   • Role (controller/processor): Processor

3. Categories of data subjects whose personal data is transferred:
   Unless otherwise agreed by the parties in writing in the Principal Agreement or an applicable Data Processing Exhibit, categories of data subjects may include the following:

   • Employees, Staff augmentation resources, contractors.
   • Candidates / Job Applicants.
   • Customers.
   • Prospective customers.
   • Website / App end users
   • Other categories such as influencers, hosts, presenters, etc.
4. Categories of personal data transferred:
   Unless otherwise agreed by the parties in writing in the Principal Agreement or an applicable Data Processing Exhibit, categories of personal data may include the following if in scope of the Principal Agreement:

   • Contact information (including but not limited to name, work email address and telephone number)
   • Online / Device Data (including but not limited to IP address, Device ID).
   • Application / Website use data (including but not limited to application / website use history or logs; data from cookies, pixels, beacons, or similar tracking tools, including in emails, social media use or interaction data; product review data)
   • Communications data (including but not limited to social media communications; technical data from communications; subscriptions to emails, newsletters).
   • Analytics data (including but not limited to attitudes, abilities, opinions, or other data to build a customer profile; preferences; purchasing or use tendencies; inferences or segmentation data).
   • Customers’ purchase Data (including purchase history; returns history; items considered but not purchased; fraud / abusive behaviors)
   • Financial and payment data.
   • Candidates / Job applicants’ data (including but not limited to CVs and prior work data)
5. Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures:
   None, unless otherwise specified in the applicable Data Processing Exhibit. Where sensitive or special-category personal data is to be transferred, the parties shall agree specific additional safeguards in the applicable Data Processing Exhibit before any such transfer takes place. The BAA may also apply if HIPAA related data is in scope.
6. The frequency of the transfer (e.g., whether the data is transferred on a one-off or continuous basis)
   On a continuous basis throughout the term of the Principal Agreement, unless otherwise specified in the applicable Data Processing Exhibit.
7. Nature of the processing
   Provision of the Services under the Principal Agreement
8. Purpose(s) of the data transfer and further processing
   Unless otherwise specified in the applicable Data Processing Exhibit incorporated in the Principal Agreement (including any SOW or Order Form): the performance, delivery, management, and support of the Services described in the Principal Agreement, including account and system administration, communications with QVC Group personnel, and service-related reporting.
9. The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period
   Duration of the Principal Agreement and then deleted in accordance with Section 7 of the DPA.For purposes of Clause 8.5 of the EU Standard Contractual Clauses (and for any data subject to the UK Addendum), data exporters choose the option of deletion, without prejudice to the right of any QVC Group Company to require the return of Personal Data under Section 7.3 of the DPA.
10. Permitted Sub-Processors. For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing
    None unless otherwise agreed by the Parties in the Principal Agreement. For the avoidance of doubt, Vendor can provide QVC with a link hosting such list, however, any addition or replacement of a sub-processor after the Effective Date is subject to the notice and objection process in Section 3.1(b).
11. As of the effective date of the DPA, Vendor processes Personal Data in the following locations:
    Specified in the Principal Agreement and related Statement of Work or Order Form.
12. Vendor's email address for receiving notices of exercises of Data Subject Rights is as follows: Vendor represents and warrants that an appropriate email address for receiving notices of exercises of Data Subject Rights is provided in its publicly available Privacy Policy.

SCHEDULE – QVC Group Companies
(Data Exporters under the EU Standard Contractual Clauses and UK Addendum)

The QVC Group Companies listed below may be party to a Principal Agreement; not all of them will be a controller or data exporter for the purposes of the EU Standard Contractual Clauses / UK Addendum. Where a listed entity acts as a controller and data exporter in respect of a restricted transfer, it does so under the EU Standard Contractual Clauses and/or the UK Addendum as applicable. Each such entity is an autonomous controller and data exporter (not a joint controller), consistent with Annex I.A of the Data Processing Exhibit and Section 9.6. 7Each QVC Group Companies that are a party to (or named in) the applicable Principal Agreement is data exporter for that transaction. QVC may update this Schedule from time to time in accordance with Section 9.7, including adding or removing entities or updating their contact details.

QVC Group, Inc., whose registered address is 1200 Wilson Drive, West Chester, Pennsylvania 19380. Address Attention: General Counsel, 1200 Wilson Drive, West Chester, Pennsylvania 19380.

QVC Handel S.à r.l. & Co. KG; QVC eService LLC & Co. KG; QVC Grundstücksverwaltungs GmbH; QVC eDistribution LLC & Co. KG: Address: Attention: General Counsel, Plockstraße 30, 40221 Düsseldorf, Deutschland; Telephone: +49 (0) 211-3007-5292; Fax: +49 (0) 211-3007-5838; Email: DE-QVCLegalServices@qvc.com.
Data Protection Officer: Thorsten Behling, BUSE Rechtsanwälte Steuerberater, Partnerschaftsgesellschaft mbB, Berliner Allee 41, 40212 Düsseldorf. Email: behling@buse.de
Competent Supervisory Authority: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen

QVC Italia S.r.l.: ATTENTION: Director of Legal Affairs, Via Guzzina 18, 20861 Brugherio (MB), Italy; Telephone: +39 039 989 2300; Fax: N/A; Email: Italy.privacy@qvc.com.
Data Protection Officer: Gabriele Giunta, Building 8, Chiswick Park, 566 Chiswick High Road, London W4 5XU, United Kingdom
Competent Supervisory Authority: Garante per la Protezione dei Dati Personali

QVC Japan, Inc. whose registered address is 2-1-1, Hibino, Mihama-ku, Chiba City, Chiba, Japan 261-8533. Address: Attention: General Counsel, 2-1-1, Hibino, Mihama-ku, Chiba City, Chiba, Japan 261-8533;.

QVC Group Global Business Services Sp. z o.o.: Registered office: Wielicka 30, 30-552 Kraków, Poland. Attention: General Counsel, Building 8, Chiswick Park, 566 Chiswick High Road, London W4 5XU, United Kingdom; Telephone: +44 (0) 208 811 5387; Fax: N/A; Email: UK-Legal@qvc.com.
Data Protection Officer: Gabriele Giunta, Building 8, Chiswick Park, 566 Chiswick High Road, London W4 5XU, United Kingdom
Competent Supervisory Authority: Urząd Ochrony Danych Osobowych

QVC UK: Attention: General Counsel, Building 8, Chiswick Park, 566 Chiswick High Road, London W4 5XU, United Kingdom; Telephone: +44 (0) 208 811 5387; Fax: N/A; Email: UK-Legal@qvc.com.
Data Protection Officer: Gabriele Giunta, Building 8, Chiswick Park, 566 Chiswick High Road, London W4 5XU, United Kingdom
Competent Supervisory Authority: Information Commissioner’s Office.