This US Data Processing Addendum ("Addendum") is attached to and forms part of the Agreement between LGEUS and Vendor. To the extent that any terms or conditions in this Addendum contradict or conflict with any terms or conditions regarding the processing of Personal Information in the Agreement or any other agreement between the Parties, the provisions requiring the higher level of data privacy or security protection for individual persons shall prevail.

1. Definitions. In this Addendum, the following terms have the stated meanings unless the context requires otherwise:

1.1 "Applicable Privacy Law" means all laws and regulations as applicable to either party's processing of personal information under the Agreement, including, but not limited to (i) the California Consumer Privacy Act ("CCPA"), Virginia Consumer Data Protection Act ("VCDPA"), Colorado Privacy Act ("CPA"), Utah Consumer Privacy Act ("UCPA"), Connecticut Data Privacy Act, and similar privacy laws as maybe enacted, collectively with their implementing regulations and as amended or superseded from time to time (collectively, "State Privacy Laws"); (ii) the Federal Trade Commission Act; and (iii) the Children's Online Privacy Protection Act.

1.2 "Business" or "Controller" may be used interchangeably and mean a sole proprietorship, partnership, limited liability company, corporation, association or other legal entity that collects PI (defined below), or on the behalf of which such information is collected.

1.3 "Business Purpose" means the use of PI for the business's or a service provider's operational purposes, or other notified purposes, provided that the use of PI will be reasonably necessary and proportionate to achieve the operational purpose for which the PI was processed or foranother operational purpose that is compatible with the context in which the PI was collected.

1.4 "Consumer" means a natural person who is a resident of the United States.

1.5 "LGE Data" means all information and data that is, in relation to the Agreement: (i) provided by or on behalf of LGEUS, its affiliates, customers, or its users to Vendor; (ii) obtained, developed, produced or processed by Vendor (including its sub-processors) by or for the benefit of LGEUS or its affiliates; (iii) derived based on the information described in (i) or (ii); or (iv) includes PI or SPI (defined below). Notwithstanding the foregoing, LGE Data excludes any data or information expressly defined as owned by Vendor in the Agreement and which is not subject to any restrictions on use or disclosure.

1.6 "LGEUS" means LG Electronics USA, Inc. or an affiliated entity, if the Agreement is between Vendor and the affiliated entity.

1.7 "Personal Information," "PI" or "Personal Data"may be used interchangeably and mean information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked with a Consumer or household, and any other information identified as personal information or personal data under Applicable Privacy Law.

1.8 "[P]rocess[ing]" means any operation(s) performed on PI, whether or not by automatic means, such as collection, storage, adaptation or alteration, retrieval, consultation, use, disclosure, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction, and any other activity identified as processing underApplicable Privacy Law.

1.9 "Sensitive Personal Information" ("SPI") or "Sensitive Information" may be used interchangeably and have the meaning given such terms under Applicable Privacy Law.

1.10 "Service provider", "Contractor" and "Processor"may be used interchangeably, and all mean a person or entity that Processes PI on behalf of a Business and that receives from or on behalf of the Business a Consumer's PI for a Business Purpose pursuant to a written contract.

1.11 "Sell" and "Share" have the meanings given to such terms under Applicable Privacy Law.

2. Relationship of the Parties. In providing LGEUS with the Services, Vendor or an outside entity engaged by Vendor in relation to the Services ("subcontractor" or "sub-processor") may receive, obtain, develop, produce or otherwise Process LGE Data, including PI or SPI. For the avoidance of doubt, LGEUS is a Business engaging Vendor as a Service Provider to Process LGE Data on its behalf and in furtherance of one or more enumerated Business Purposes under Applicable Privacy Law. The specific nature and purpose of the Processing of PI, and the type of PI, is set forth in the SOW. The duration of Processing is the term of the Agreement.

3. Vendor Obligations.

3.1 In Processing PI, Vendor shall:

a) comply with Applicable Privacy Law and ensure any person Processing the PI is subject to a duty of confidentiality;

b) not collect, use, retain, disclose or otherwise process PI except: (i) pursuant to LGEUS's documented instructions; (ii) as necessary to perform the Services for the Business Purpose(s) specified in the Agreement; (iii) within the direct business relationship of the Parties; (iv) to build or improve the quality of Vendor's services, provided that the use does not include building or modifying household or consumer profiles to use in providing services to another business or correcting, combining or augmenting data acquired from another source; (v) to detect security incidents or protect against malicious, deceptive, fraudulent or illegal activity; or (vi) as required by applicable law; and

c) not Sell or Share PI, and not combine LGE Data with PI it receives from or on behalf of another person or entity or that it collects from its own interaction with a Consumer unless otherwise required by applicable law.

3.2 Vendor shall comply with the LG Data Protection Policy (http://www.lg.com/us/dpp). Vendor shall allow, and cooperate with, reasonable assessments by LGEUS or its designated assessor, or alternatively, arrange for a qualified and independent assessor to assess Vendor's policies and technical and organizational measures in support of the obligations under Applicable Privacy Law using an appropriate and accepted control standard or framework and assessment procedure for such assessments, and provide a report of such assessment to LGEUS upon request.

3.3 Consumer Data Subject Rights Requests:

a) Without undue delay and in any event within five (5) business days of receiving a data subject rights request ("DSR") from a Consumer pursuant to Applicable Privacy Law, Vendor shall comply with Applicable Privacy Law in responding to any DSR, including notifying LGEUS and in a timely manner providing to LGEUS all reasonable assistance to meet LGEUS's response obligations under Applicable Privacy Law.

b) Upon LGEUS's written instructions Vendor shall without undue delay and in any event within three (3) business days of LGEUS's written instructions, as directed: (i) delete, provide information about, provide a copy of and/or correct, a Consumer's PI; (ii) limit the use of SPI; and/or(iii) opt the Consumer out of third-party targeted advertising and any Sale or Share of PI previously approved by LGEUS.

c) Vendor shall promptly inform LGEUS in writing of any third party or governmental complaints or inquiries it receives in connection with PI Processed under the Agreement.

3.4 Upon termination or expiration of the Agreement, Vendor shall return or destroy all LGE Data to LGEUS and subsequently and without undue delay delete any copies of same. Any LGE Data retained beyond termination or expiration (such as where required by applicable law) shall remain subject to this Addendum until returned or destroyed.

3.5 In its use of subcontractors/sub-processors, Vendor shall:

a) provide LGEUS an up-to-date list of all Vendor subcontractors/sub-processors prior to allowing any subcontractor/sub-processor access to PI, and shall provide notice of any change in subcontractor/sub-processor thirty (30) days prior to any such change, and confirm within ten (10) days afterward;

b) not share or transfer LGE Data or delegate or assign any of its rights or obligations concerning LGE Data to any subcontractors/sub-processors or other outside entity without LGEUS's prior specific written consent;

c) contractually require that all subcontractors/sub-processors comply with terms no less restrictive than the terms of this Addendum; and

d) make reasonable efforts to monitor subcontractor/sub-processor compliance and ensure that all subcontractors/sub-processors comply with Applicable Privacy Law.

3.6 Upon the reasonable request of LGEUS, Vendor shall make available all information necessary to demonstrate its compliance with Applicable Privacy Law. LGEUS shall have the right, upon notice, to take reasonable and appropriate steps to stop and remediate any unauthorized use of PI by Vendor. Vendor shall notify LGEUS if Vendor (including its subcontractors/sub-processors) can no longer meet its obligations under Applicable Privacy Law.

3.7 This Addendum will remain in force until the date on which the Agreement expires or is terminated in accordance with its terms. Any material breach of this Addendum by Vendor which is curable and which Vendor does not cure within ten (10) business days of notification of breach by LGEUS shall constitute a material breach of the Agreement.

4. Vendor Certification. Vendor understands that it is prohibited from (a)Selling or Sharing LGE Data; (b) collecting, retaining, using, disclosing or otherwise Processing LGE Data for any purpose other than providing the Services, including retaining, using, or disclosing PI except for the specific Business Purpose specified in the Agreement; and (c) collecting, retaining, using, disclosing or otherwise Processing any LGE Data outside the direct business relationship between LGEUS and Vendor. By signing the Agreement, Vendor certifies that it will comply with such restrictions, and that it has no reason to believe that any legal or contractual obligation applicable to it prevents it from either providing the Services or fulfilling its obligations under this Addendum.

5. Indemnification & Liability Vendor agrees that a breach or threatened breach of this Addendum by Vendor or its agents or subcontractors/sub-processors may cause irreparable harm to LGEUS such that monetary damages may not provide an adequate remedy. Vendor accordingly agrees that LGEUS may seek injunctive or other equitable relief to prevent or remedy such breach or threatened breach without requirement of bond or notice.

Vendor agrees to defend, indemnify, and hold harmless LGE and its directors, officers, parents, subsidiaries, affiliates, employees, subcontractors/sub-processors, and agents from and against all claims, suits, causes of action, damages, costs (including the costs of any remediation efforts and reasonable attorneys' fees), judgments and other expenses with respect to any third party claim and arising out of or related to Vendor's: (i) breach of this Addendum (including any purpose oruse restrictions relating to LGE Data as may be contained in the Agreement); or (ii) security incident; or (iii) violation of Applicable Privacy Law. Notwithstanding any other provision of the Agreement, Vendor's limitation on liability under this Addendum will equal the greater of five million dollars ($5,000,000), two (2) times the value of the Agreement or the amount specified in the Agreement, except in the case of gross negligence or willful breach of this addendum, in which case no limitation of liability will apply.

6. New Privacy Laws. Vendor agrees and warrants that it will work in good faith with LGEUS to ensure its performance of the Services and any Processing of PI or SPI complies with any new, amended or superseded Applicable Privacy Law, and if LGEUS notifies Vendor that an amendment to this Addendum is appropriate to comply with Applicable Privacy Law then in effect (or going into effect),and the parties are unable to reach agreement on such amendment within thirty (30) days, LGEUS reserves the right to terminate the Agreement upon written notice.

Notwithstanding the foregoing, to the extent New Privacy Laws require inclusion of a specific contractual provision not included in this Addendum, that provision is deemed included in this Addendum ("Deemed Included Provision"). LGEUS may supplement this Addendum at any time to include a Deemed Included Provision as necessary to comply with Applicable Law by sending a notice to Vendor with the Deemed Included Provision. The Deemed Included Provision will be deemed effective as required by the New Privacy Law.

7. Severability If any term of this Addendum is determined by a court of competent jurisdiction to be, to any extent, illegal, otherwise invalid, or incapable of being enforced, such a term shall be excluded to the extent of such invalidity or unenforceability; all other terms herein shall remain in full force and effect; and, to the extent permitted and possible, the invalid or unenforceable term shall be deemed replaced by a term that is valid and enforceable and that comes closest to expressing the intention of such invalid or unenforceable term.