Data Processing and Security Terms for Looker Services (Customers)

The customer agreeing to these terms ("Customer"), and Looker Data Sciences Inc. ("Looker"), have entered into an agreement under which Looker has agreed to provide the Services and, if applicable, related technical support to Customer (as amended from time to time, the "Agreement").

1. Commencement

These Data Processing and Security Terms for Looker Services, including their appendices (the "Terms") will be effective and replace any previously applicable data processing and security terms as from the Terms Effective Date (as defined below). These Terms supplement the Agreement.

2. Definitions

2.1 Capitalized terms defined in the Agreement apply to these Terms. In addition, in these Terms:

• Additional Security Controls means security resources, features, functionality and/or controls, the use of which is controlled by Customer, including the identity and access management functionality of the Services.
• Affiliated Infrastructure Provider means, if applicable, a Looker Affiliate that is authorized under these Terms to supply any applicable cloud-based infrastructure included in the Services.
• Agreed Liability Cap means the maximum monetary or payment-based amount at which a party's liability is capped under the Agreement.
• Alternative Transfer Solution means a solution, other than the Model Contract Clauses, that enables the lawful transfer of personal data to a third country in accordance with European Data Protection Law.
• Audited Services means the Services when hosted on their integrated cloud-based infrastructure but excluding such infrastructure from the scope of any relevant certification or report.
• Customer Data has the meaning given in the Agreement.
• Customer End Users has the meaning given in the Agreement or, if no such meaning is given, has the meaning given to "End Users" in the Agreement.
• Customer Personal Data means the personal data contained within the Customer Data.
• Data Incident means a breach of Looker's security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Data on systems managed by or otherwise controlled by Looker.
• EEA means the European Economic Area.
• EU GDPR means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.
• European Data Protection Law means, as applicable: (a) the GDPR; and/or (b) the Federal Data Protection Act of 19 June 1992 (Switzerland).
• European or National Law means, as applicable: (a) EU or EU Member State law (if the EU GDPR applies to the processing of Customer Personal Data); and/or (b) the law of the UK or a part of the UK (if the UK GDPR applies to the processing of Customer Personal Data).
• GDPR means, as applicable: (a) the EU GDPR; and/or (b) the UK GDPR.
• Infrastructure Provider means an Affiliated Infrastructure Provider or an Unaffiliated Infrastructure Provider, as applicable.
• Looker's Third Party Auditor means a Looker-appointed, qualified and independent third party auditor, whose then-current identity Looker will disclose to Customer.
• Model Contract Clauses or MCCs mean standard data protection clauses for the transfer of personal data to processors established in third countries which do not ensure an adequate level of data protection, as described in Article 46 of the EU GDPR and set out at https://looker.com/trust-center/legal/customers/mcc.
• Non-European Data Protection Law means data protection or privacy laws in force outside the European Economic Area, Switzerland and the UK.
• Notification Email Address means the email address(es) designated by Customer in the Order Form or via the Services (as applicable) to receive certain notifications from Looker. Customer is responsible for giving Looker timely notice of any changes to the email address(es) so designated and for ensuring that its Notification Email Address remains current and valid.
• Order Form has the meaning given in the Agreement, unless Customer has purchased via a reseller or online marketplace or is using the Services only for trial or evaluation purposes under a trial or evaluation agreement, in which case "Order Form" may mean another written form (email or other electronic means permitted) as authorised by Looker.
• Security Documentation means any and all documents and information made available by Looker under Section 7.5.1 (Reviews of Security Documentation).
• Security Measures has the meaning given in Section 7.1.1 (Looker's Security Measures).
• Subprocessor means a third party authorized as another processor under Section 11 (Looker Subprocessors) to have logical access to and process Customer Data in order to provide parts of the Services and any applicable technical support.
• Subprocessor URL has the meaning given in Section 11.2 (Information about Subprocessors).
• Supervisory Authority means, as applicable: (a) a "supervisory authority" as defined in the EU GDPR; and/or (b) the "Commissioner" as defined in the UK GDPR.
• Term means the period from the Terms Effective Date until the end of Looker's provision of the Services, including, if applicable, any period during which provision of the Services may be suspended and any post-termination period during which Looker may continue providing the Services for transitional purposes.
• Terms Effective Date means the date on which Customer accepted, or the parties otherwise agreed to, these Terms.
• UK GDPR means the EU GDPR as amended and incorporated into UK law under the UK European Union (Withdrawal) Act 2018, if in force.
• Unaffiliated Infrastructure Provider or UIP means, if applicable, a third party, other than a Looker Affiliate, that is authorized under these Terms to supply any applicable cloud-based infrastructure included in the Services.

2.2 The terms "personal data", "data subject", "processing", "controller" and "processor" as used in these Terms have the meanings given in the GDPR irrespective of whether European Data Protection Law or Non-European Data Protection Law applies.

3. Duration

These Terms will, notwithstanding expiry of the Term, remain in effect until, and automatically expire upon, deletion of all Customer Data by Looker as described in these Terms.

4. Scope of Data Protection Law

4.1 Application of European Law. The parties acknowledge that European Data Protection Law will apply to the processing of Customer Personal Data if, for example:

1. the processing is carried out in the context of the activities of an establishment of Customer in the territory of the EEA or the UK; and/or
2. the Customer Personal Data is personal data relating to data subjects who are in the EEA or the UK and the processing relates to the offering to them of goods or services in the EEA or the UK, or the monitoring of their behavior in the EEA or the UK.

4.2 Application of Non-European Law. The parties acknowledge that Non-European Data Protection Law may also apply to the processing of Customer Personal Data.

4.3 Application of Terms. Except to the extent these Terms state otherwise, these Terms will apply irrespective of whether European Data Protection Law or Non-European Data Protection Law applies to the processing of Customer Personal Data.

5. Processing of Data

5.1 Roles and Regulatory Compliance; Authorization.

5.1.1 Processor and Controller Responsibilities. If European Data Protection Law applies to the processing of Customer Personal Data:

1. the subject matter and details of the processing are described in Appendix 1;
2. Looker is a processor of that Customer Personal Data under European Data Protection Law;
3. Customer is a controller or processor, as applicable, of that Customer Personal Data under European Data Protection Law; and
4. each party will comply with the obligations applicable to it under European Data Protection Law with respect to the processing of that Customer Personal Data.

5.1.2 Authorization by Third Party Controller. If European Data Protection Law applies to the processing of Customer Personal Data and Customer is a processor, Customer warrants that its instructions and actions with respect to that Customer Personal Data, including its appointment of Looker as another processor, have been authorized by the relevant controller.

5.1.3 Responsibilities under Non-European Law. If Non-European Data Protection Law applies to either party's processing of Customer Personal Data, the relevant party will comply with any obligations applicable to it under that law with respect to the processing of that Customer Personal Data.

5.2 Scope of Processing.

5.2.1 Customer's Instructions. Customer instructs Looker to process Customer Personal Data in accordance with applicable law only: (a) to provide the Services and any applicable technical support; (b) as further specified via Customer's use of the Services and any applicable technical support; (c) as documented in the form of the Agreement, including these Terms; and (d) as further documented in any other written instructions given by Customer and acknowledged by Looker as constituting instructions for purposes of these Terms.

5.2.2 Looker's Compliance with Instructions. Looker will comply with the instructions described in Section 5.2.1 (Customer's Instructions) (including with regard to data transfers) unless European or National Law to which Looker is subject requires other processing of Customer Personal Data by Looker, in which case Looker will notify Customer (unless that law prohibits Looker from doing so on important grounds of public interest) before such other processing.

6. Data Deletion

6.1 Deletion by Customer. Looker will enable Customer to delete certain Customer Data during the Term in a manner consistent with the functionality of the Services. If Customer uses the Services to delete any Customer Data during the Term and that Customer Data cannot be recovered by Customer, this use will constitute an instruction to Looker to delete the relevant Customer Data from Looker's systems in accordance with applicable law. Looker will comply with this instruction as soon as reasonably practicable and within a maximum period of 180 days, unless European or National Law requires storage.

6.2 Deletion on Termination. On expiry of the Term, Customer instructs Looker to delete all Customer Data (including existing copies) from Looker's systems in accordance with applicable law. Looker will, after a recovery period of up to 30 days following such expiry, comply with this instruction as soon as reasonably practicable and within a maximum period of 180 days, unless European or National Law requires storage. Without prejudice to Section 9.1 (Access; Rectification; Restricted Processing; Portability), Customer is responsible for exporting, before the Term expires, any Customer Data it wishes to retain.

7. Data Security

7.1 Looker's Security Measures, Controls and Assistance.

7.1.1 Looker's Security Measures. Looker will implement and maintain technical and organizational measures to protect Customer Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access as described in Appendix 2 (the "Security Measures"). The Security Measures may include measures to encrypt personal data; to help ensure ongoing confidentiality, integrity, availability and resilience of Looker's systems and services; to help restore timely access to personal data following an incident; and for regular testing of effectiveness. Looker may update the Security Measures from time to time provided that such updates do not result in the degradation of the overall security of the Services.

7.1.2 Security Compliance by Looker Staff. Looker will: (a) take appropriate steps to ensure compliance with the Security Measures by its employees, contractors and Subprocessors to the extent applicable to their scope of performance, and (b) ensure that all persons authorized to process Customer Personal Data are under an obligation of confidentiality.

7.1.3 Additional Security Controls. Looker will make Additional Security Controls available to: (a) allow Customer to take steps to secure Customer Data; and (b) provide Customer with information about securing, accessing and using Customer Data.

7.1.4 Looker's Security Assistance. Looker will (taking into account the nature of the processing of Customer Personal Data and the information available to Looker) assist Customer in ensuring compliance with its obligations pursuant to Articles 32 to 34 of the GDPR, by:

1. implementing and maintaining the Security Measures in accordance with Section 7.1.1 (Looker's Security Measures);
2. making Additional Security Controls available to Customer in accordance with Section 7.1.3 (Additional Security Controls);
3. complying with the terms of Section 7.2 (Data Incidents);
4. providing Customer with (i) any Security Documentation maintained under Section 7.4 (Compliance Certification and SOC Report) in accordance with Section 7.5.1 (Reviews of Security Documentation) and (ii) the information contained in the Agreement including these Terms; and
5. complying with the terms of Section 11 (Looker Subprocessors) and, if applicable, Section 12 (Unaffiliated Infrastructure Providers).

7.2 Data Incidents.

7.2.1 Incident Notification. Looker will notify Customer promptly and without undue delay after becoming aware of a Data Incident, and promptly take reasonable steps to minimize harm and secure Customer Data.

7.2.2 Details of Data Incident. Looker's notification of a Data Incident will describe, to the extent possible, the nature of the Data Incident, the measures taken to mitigate the potential risks and the measures Looker recommends Customer take to address the Data Incident.

7.2.3 Delivery of Notification. Notification(s) of any Data Incident(s) will be delivered to the Notification Email Address.

7.2.4 No Assessment of Customer Data by Looker. Looker has no obligation to assess Customer Data in order to identify information subject to any specific legal requirements.

7.2.5 No Acknowledgement of Fault by Looker. Looker's notification of or response to a Data Incident under this Section 7.2 (Data Incidents) will not be construed as an acknowledgement by Looker of any fault or liability with respect to the Data Incident.

7.3 Customer's Security Responsibilities and Assessment.

7.3.1 Customer's Security Responsibilities. Without prejudice to Looker's obligations under Sections 7.1 (Looker's Security Measures, Controls and Assistance) and 7.2 (Data Incidents) and elsewhere in the Agreement, Customer is responsible for its use of the Services; its use and storage of Customer Data outside of systems managed or otherwise controlled by Looker, and the security of Customer's environment, databases and configuration of the Services. Systems managed and controlled by Looker include Subprocessors, Looker Affiliates', and/or any Unaffiliated Infrastructure Provider's systems. Customer's responsibilities under this Section 7.3.1 (Customer's Security Responsibilities) include, without limitation:

1. using the Services and Additional Security Controls to ensure a level of security appropriate to the risk in respect of the Customer Data;
2. securing the account authentication credentials, systems and devices Customer uses to access the Services; and
3. backing up its Customer Data as appropriate.

7.3.2 Customer's Security Assessment. Customer agrees, based on its current and intended use of the Services, that the Services, Security Measures, Additional Security Controls and Looker's commitments under this Section 7 (Data Security), Section 11 (Looker Subprocessors) and, if applicable, Section 12 (Unaffiliated Infrastructure Providers): (a) meet Customer's needs, including with respect to any security obligations of Customer under European Data Protection Law and/or Non-European Data Protection Law, as applicable, and (b) provide a level of security appropriate to the risk in respect of the Customer Data.

7.4 Compliance Certification and SOC Report. Looker will ensure that one or more of the following is/are maintained for the Audited Services in order to evaluate the continued effectiveness of the Security Measures: (a) certificate(s) for ISO 27001 DSS Attestation of Compliance (collectively, the "Compliance Certification(s)"); and/or (b) a SOC 2 report produced by Looker's Third Party Auditor and updated annually based on an audit performed at least once every 12 months (the "SOC Report"). The Compliance Certification(s) and/or SOC Report maintained for the Audited Services under this Section 7.4 (Compliance Certification and SOC Report) may vary according to the hosting environment in which such Services are used; Looker will provide details of the Compliance Certification(s) and SOC Report available for specific hosting environments on request. Looker may also add standards and/or replace any Compliance Certification or SOC Report with an equivalent or enhanced alternative at any time.

7.5 Reviews and Audits of Compliance.

7.5.1 Reviews of Security Documentation. Looker will make any Compliance Certification(s) and/or SOC Report maintained under Section 7.4 (Compliance Certification and SOC Report) available for review by Customer to demonstrate compliance by Looker with its obligations under these Terms.

7.5.2 Customer's Audit Rights.

1. If European Data Protection Law applies to the processing of Customer Personal Data, Looker will allow Customer or an independent auditor appointed by Customer to conduct audits (including inspections) to verify Looker's compliance with its obligations under these Terms in accordance with Section 7.5.3 (Additional Business Terms for Reviews and Audits). Looker will contribute to such audits as described in Section 7.4 (Compliance Certification and SOC Report) and this Section 7.5 (Reviews and Audits of Compliance).
2. If Looker and Customer have entered into the Model Contract Clauses under Section 10.2 (Transfers of Data), Looker will allow Customer or an independent auditor appointed by Customer to conduct audits as described in the Model Contract Clauses in accordance with Section 7.5.3 (Additional Business Terms for Reviews and Audits).
3. Customer may conduct an audit to verify Looker's compliance with its obligations under these Terms by reviewing any available Security Documentation (which will reflect the outcome of audits conducted by Looker's Third Party Auditor or another third party auditor).

7.5.3 Additional Business Terms for Reviews and Audits.

1. Customer must send any requests for SOC Report reviews under Section 7.5.1 or audits under Section 7.5.2(a) or 7.5.2(b) to Looker's Data Protection Team as described in Section 13 (Data Protection Team; Processing Records).
2. Following receipt by Looker of a request under Section 7.5.3(a), Looker and Customer will discuss and agree in advance on: (i) the reasonable date(s) of and security and confidentiality controls applicable to any SOC Report review under Section 7.5.1; and (ii) the reasonable start date, scope and duration of and security and confidentiality controls applicable to any audit under Section 7.5.2(a) or 7.5.2(b).
3. Looker may charge a fee (based on Looker's reasonable costs) for any audit under Section 7.5.2(a) or 7.5.2(b). Looker will provide Customer with further details of any applicable fee, and the basis of its calculation, in advance of any such audit. Customer will be responsible for any fees charged by any auditor appointed by Customer to execute any such audit.
4. Looker may object in writing to an auditor appointed by Customer to conduct any audit under Section 7.5.2(a) or 7.5.2(b) if the auditor is, in Looker's reasonable opinion, not suitably qualified or independent, a competitor of Looker, or otherwise manifestly unsuitable. Any such objection by Looker will require Customer to appoint another auditor or conduct the audit itself.

7.5.4 No Modification of MCCs. Nothing in this Section 7.5 (Reviews and Audits of Compliance) varies or modifies any rights or obligations of Customer or Looker under any Model Contract Clauses entered into as described in Section 10.2 (Transfers of Data).

8. Impact Assessments and Consultations

Looker will (taking into account the nature of the processing and the information available to Looker) assist Customer in ensuring compliance with its obligations pursuant to Articles 35 and 36 of the GDPR, by:

1. providing Additional Security Controls in accordance with Section 7.1.3 (Additional Security Controls) and any Security Documentation made available under Section 7.5.1 (Reviews of Security Documentation); and
2. providing the information contained in the Agreement including these Terms.

9. Access etc.; Data Subject Rights; Data Export

9.1 Access; Rectification; Restricted Processing; Portability. During the Term, Looker will enable Customer, in a manner consistent with the functionality of the Services, to (a) access, rectify and restrict processing of Customer Data, including via the deletion functionality provided by Looker as described in Section 6.1 (Deletion by Customer), and (b) export Customer Data.

9.2 Data Subject Requests.

9.2.1 Customer's Responsibility for Requests. During the Term, if Looker's Data Protection Team receives a request from a data subject in relation to Customer Personal Data, and the request identifies Customer, Looker will advise the data subject to submit their request to Customer. Customer will be responsible for responding to any such request including, where necessary, by using the functionality of the Services.

9.2.2 Looker's Data Subject Request Assistance. Looker will (taking into account the nature of the processing of Customer Personal Data) assist Customer in fulfilling its obligations under Chapter III of the GDPR to respond to requests for exercising the data subject's rights by:

1. providing the Services including the query and reporting functionality of the Services in accordance with the Agreement; an
2. complying with Sections 9.1 (Access; Rectification; Restricted Processing; Portability) and 9.2.1 (Customer's Responsibility for Requests).

10. Data Transfers

10.1 Data Storage and Processing Facilities. Looker may store and process Customer Data anywhere Looker, its Subprocessors or any Unaffiliated Infrastructure Provider maintains facilities, subject to Section 10.2 (Transfers of Data) with respect to the Model Contract Clauses or Alternative Transfer Solution.

10.2 Transfers of Data. Subject to Section 12.3 (Requirements for UIP Engagement), if the storage and/or processing of Customer Personal Data involves transfers of Customer Personal Data from the EEA, Switzerland or the UK to any third country that does not ensure an adequate level of protection under European Data Protection Law, and European Data Protection Law applies to the transfers of such data, then:

1. if Customer (as data exporter) enters into the Model Contract Clauses with Looker (as data importer) in offline form, the transfers will be subject to the Model Contract Clauses; or
2. if Customer does not enter into the Model Contract Clauses with Looker as described in Section 10.2(a), then:
   1. if an Alternative Transfer Solution is made available by Looker:
   2. Customer will be deemed to be using it and will take any action (which may include execution of documents) strictly required to give it full effect; and
   3. Looker will ensure that the transfers are made in accordance with such Alternative Transfer Solution; or
   4. if an Alternative Transfer Solution is not made available by Looker:
   5. Customer (as data exporter) will be deemed to have entered into the Model Contract Clauses with Looker (as data importer); and
   6. the transfers will be subject to the Model Contract Clauses.

10.3 Disclosure of Confidential Information Containing Personal Data. If Looker and Customer have entered into the Model Contract Clauses under Section 10.2 (Transfers of Data), Looker will, notwithstanding any term to the contrary in the Agreement, ensure that any disclosure of Customer's Confidential Information containing personal data, and any notifications relating to any such disclosures, will be made in accordance with such Model Contract Clauses.

11. Looker Subprocessors

11.1 Consent to Subprocessor Engagement. Customer specifically authorizes the engagement as Subprocessors of: (a) those entities listed as of the Terms Effective Date at the Subprocessor URL; and (b) all other Looker Affiliates from time to time. Such authorized Subprocessors will include any Affiliated Infrastructure Provider Customer chooses to use, as indicated in an Order Form. In addition, without prejudice to Section 11.4 (Opportunity to Object to Looker Subprocessor Changes), Customer generally authorizes the engagement as Subprocessors of any other third parties ("New Looker Subprocessors").

11.2 Information about Subprocessors. Information about Subprocessors, including their functions and locations, is available at https://looker.com/trust-center/privacy/google-cma-subprocessors and, if Customer chooses to use an Affiliated Infrastructure Provider, at https://cloud.google.com/terms/subprocessors, as both URLs may be updated from time to time in accordance with these Terms (collectively, the "Subprocessor URL").

11.3 Requirements for Subprocessor Engagement. Before engaging any Subprocessor, Looker will ensure that the Subprocessor's security and privacy practices are assessed to verify that the Subprocessor provides a level of security and privacy appropriate to the data it will access and the services it will provide. In addition, when engaging any Subprocessor, Looker will:

1. ensure via a written contract that:
   1. the Subprocessor only accesses and uses Customer Data as required to perform the obligations subcontracted to it and in accordance with the Agreement (including these Terms) and the Model Contract Clauses or Alternative Transfer Solution, as applicable under Section 10.2 (Data Transfers);
   2. if the GDPR applies to the processing of Customer Personal Data, data protection obligations equivalent to those referred to in Article 28(3) of the GDPR are imposed on the Subprocessor;
   3. if the Subprocessor is an Affiliated Infrastructure Provider:
   • the Subprocessor implements and maintains those Security Measures described in Section 4 (Affiliated Infrastructure Provider) of Appendix 2, as may be updated from time to time provided that such updates do not result in the degradation of the overall security of the Services; and
   • the Subprocessor maintains one or more of the Compliance Certification(s) and/or SOC Report described in Section 7.4 (Compliance Certification and SOC Report) for its cloud-based infrastructure included in the Services and will make any such Compliance Certification(s) and/or SOC Report available for review by Customer as described in Sections 7.5.1 (Reviews of Security Documentation) and 7.5.3 (Additional Business Terms for Reviews and Audits); and
2. remain fully liable for all obligations subcontracted to, and all acts and omissions of, the Subprocessor.

11.4 Opportunity to Object to Looker Subprocessor Changes.

1. When any New Looker Subprocessor is engaged during the Term, Looker will, at least 30 days before the date the New Looker Subprocessor is due to start processing any Customer Data (the "Subprocessor Start Date"), and subject to Section 11.4(b) below:
   1. update the Subprocessor URL to include the name, function and location of the New Looker Subprocessor; and
   2. notify Customer of the engagement of the New Looker Subprocessor (including its name, function and location) or provide a mechanism Customer can use to obtain such notices; and
2. Customer may, within 60 days of the Subprocessor Start Date, object to the New Looker Subprocessor by terminating the Agreement immediately upon written notice to Looker. This termination right is Customer's sole and exclusive remedy if Customer objects to any New Looker Subprocessor.

12. Unaffiliated Infrastructure Providers

12.1 Use of Unaffiliated Infrastructure Provider. Customer is not required to use an Unaffiliated Infrastructure Provider in order to use the Services or host them on their integrated cloud-based infrastructure. If Customer chooses to use an Unaffiliated Infrastructure Provider, as indicated in an Order Form (the "UIP Order Form"), Customer:

1. specifically authorizes the engagement of that Unaffiliated Infrastructure Provider and of any processors engaged by the Unaffiliated Infrastructure Provider as of the effective date of the UIP Order Form; and
2. without prejudice to Section 12.4 (Opportunity to Object to UIP Subprocessor Changes), generally authorizes the engagement by the Unaffiliated Infrastructure Provider of any other processors ("New UIP Subprocessors").

12.2 Information about Unaffiliated Infrastructure Provider. Information about any Unaffiliated Infrastructure Provider Customer has chosen to use, including its identity, function and location, will be included in the UIP Order Form, together with information about any processors engaged by the Unaffiliated Infrastructure Provider as of the effective date of the UIP Order Form.

12.3 Requirements for UIP Engagement. When engaging any Unaffiliated Infrastructure Provider Customer has chosen to use, Looker will:

1. ensure via a written contract that:

   1. the Unaffiliated Infrastructure Provider only accesses and uses Customer Data as required to perform the obligations subcontracted to it; and
   2. if the GDPR applies to the processing of Customer Personal Data, data protection obligations equivalent to those referred to in Article 28(3) of the GDPR are imposed on the Unaffiliated Infrastructure Provider, including with respect to data transfers; and

2. remain fully liable for all obligations subcontracted to, and all acts and omissions of, the Unaffiliated Infrastructure Provider.

12.4 Opportunity to Object to UIP Subprocessor Changes. The UIP Order Form will identify a mechanism Customer can use to obtain information about the intended engagement of any New UIP Subprocessors. Customer may object to any New UIP Subprocessor within 60 days of its start date by terminating the Agreement immediately upon written notice to Looker. This termination right is Customer's sole and exclusive remedy if Customer objects to a New UIP Subprocessor.

13. Data Protection Team; Processing Records

13.1 Looker's Data Protection Team. Looker's Data Protection Team can be contacted at
looker-data-protection@google.com (and/or via such other means as Looker may provide from time to time).

13.2 Looker's Processing Records. To the extent the GDPR requires Looker to collect and maintain records of certain information relating to Customer, Customer will, where requested, supply such information to Looker and give Looker timely notice of any changes to such information to ensure that Looker's records remain accurate and up-to-date. Looker may make any such information available to the Supervisory Authorities if required by the GDPR.

14. Liability

14.1 Liability Cap. If the Model Contract Clauses have been entered into under Section 10.2 (Transfers of Data) then, subject to Section 14.2 (Liability Cap Exclusions), the total combined liability of either party and its Affiliates towards the other party and its Affiliates under or in connection with the Agreement and such Model Contract Clauses combined will be limited to the Agreed Liability Cap for the relevant party.

14.2 Liability Cap Exclusions. Nothing in Section 14.1 (Liability Cap) will affect the remaining terms of the Agreement relating to liability (including any specific exclusions from any limitation of liability).

15. Effect of These Terms

Notwithstanding anything to the contrary in the Agreement, to the extent of any conflict or inconsistency between these Terms and the remaining terms of the Agreement, these Terms will govern.