DATA PROCESSING ADDENDUM This Data Processing Addendum (the Addendum) supplements the Agreement between Northbridge Holdings, Inc. (Controller) and Lattice Robotics LLC (Processor) and applies to all Personal Data processed under it. 2. PROCESSING. Processor shall process Personal Data solely on documented instructions from Controller, including with regard to transfers of Personal Data to a third country. 4. SUB-PROCESSORS. Processor shall not engage a sub-processor without prior written authorisation, and shall give Controller at least thirty (30) days' notice of any intended change to its sub-processors. 5. INTERNATIONAL TRANSFERS. Transfers of Personal Data outside the EEA are made under the EU Standard Contractual Clauses (Module Two), which are incorporated into this Addendum by reference. 6. PERSONAL DATA BREACH. Processor shall notify Controller without undue delay and in any event within seventy-two (72) hours of becoming aware of a Personal Data Breach. 8. AUDITS. Processor shall make available all information necessary to demonstrate compliance and shall allow for and contribute to audits conducted by Controller no more than once per calendar year. 9.1 DELETION. Upon termination of the Services, Processor shall delete or return all Personal Data within thirty (30) days, unless retention is required by law. 11.1 LIABILITY. Each party's liability under this Addendum is subject to the limitations of liability set out in the Agreement.