AGREEMENT

7/25/2018 AGREEMENT

VENDOR AGREEMENT

This Agreement for engaging of Vendor (hereafter the “Agreement’) is entered into and executed at
New Delhi on this 1-Jul-2018

By and Between

NIIT Limited , a company incorporated under the Companies Act 1956, having its registered office
at 8, Balaji Estate, First Floor, Guru Ravi Das Marg, Kalkaji, New Delhi - 110019 (hereafter referred
to as ‘NIIT’ which expression, unless repugnant to the text or context thereof shall include its
successors, affiliates and assigns) of the One Part:

And

RANGANATHAN CHANDRASEKARAN , 3/72, FIRST CROSS STREET, ,LAKSHMI NAGAR FOURTH STAGE
,CHENNAI ,Tamil Nadu ,India ,600061 - (hereafter referred to as the “Vendor”) of the Other Part.

(NIIT and the Vendor are hereafter individually referred to as the “Party” and collectively the
“Parties”)

The recitals are incorporated in and made a part of this Agreement. Titles of Articles, Sections,
Clauses and paragraphs are used for convenience only and are not a part of the Text. All terms used
in any one gender shall be construed to include any other gender as the context may require.

RECITALS

1. WHEREAS NIIT is interalia engaged in the business of practice oriented – training on
application software used by the banking, financial services & insurance industry as also the
conscious development of Behavioral and Personality traits interwoven in the program
curriculum which modern financial professionals employed by the BFSI sector require by
employing the usage of Modern techniques of learning viz case discussions, assignments and
projects etc. through its facilities, which include its education centers, trained faculty, suitable
courseware being the student training material or method, faculty training material, method
or material, other educational aid or devise or methods and other support facilities

2. AND WHEREAS NIIT is providing such practice oriented – training to members of public and
industry at large and requires the services of specialists in the said field

3. AND WHEREAS the Vendor has expressed his/her desire of rendering the said consultancy
services to NIIT for the purposes set out in preceding Recital and on the terms and conditions
contained hereinafter in this Agreement.

Now in Consideration of the Premises, Mutual Promises, Covenants, Warranties and Provisions set
forth hereinafter, the Parties hereto agree as follows: -

1. Engagement of the Vendor and the Scope of the Services

1.1 Subject to the provisions hereof, NIIT agrees to engage the Vendor for a period of 2 Months
beginning 1-Jul-2018 to 31-Aug-2018 and the Vendor agrees to provide, the Services to
NIIT as per agreed schedules per month, during the Term and in accordance with the
instructions and requirements of NIIT.

1.2 The Services to be provided by the Vendor shall include the following:- 1/26

(a) Education Training delivery and related activities.

https://www.tecknowhive.com/Tecknowhive/Workflow/Agreement/PSP/PSPRegFacTemplate_V2.aspx?strMSAID=EjtFcbE9pOE=&flag=3

7/25/2018 AGREEMENT

(b) The Vendor is also required to provide any other services that may be required and
assigned by NIIT to the Vendor from time to time.

(Herein before and hereinafter referred to as the “Services”)

1.3 It is agreed by the Vendor that the Services provided by the Vendor shall be of the nature,
quality and in accordance with the Schedule as required and stipulated by NIIT. In particular,
the Vendor shall ensure that the Services are provided with the due care and diligence. The
responsibility of the Vendor with respect to the provision of the Services shall continue and be
effective until the Services have been actually and effectively provided to NIIT.

1.4 All the deliverables forming part of the Services, the schedules, duration and the manner of
provision of the Services and the venue and location for the conduct thereof shall be decided
by NIIT, and the same shall be strictly adhered to and followed by the Vendor in provision of
the Services.

1.5 As NIIT is in the business of providing training services, the Vendor understands that the
work assigned to him under this Agreement is very critical for NIIT Business and therefore the
same has to be completed within the prescribed time/schedule. Irregular work by the Vendor
will amount to serious breach of this Agreement.

1.6 It is expressly understood and agreed between the Parties that the engagement of the
Vendor and the provision of the Services by the Vendor shall be non-exclusive in nature and
NIIT shall have the unqualified and unfettered right to appoint additional Vendors for
providing the Services or such other services that are similar to the Services during the Term.

1.7 NIIT offers no minimum commitment whatsoever regarding the quantum or volume of
Services that may be required to be provided by the Vendor during the Term of this
Agreement.

1.8 The Vendor agrees with NIIT throughout the Term: -
(a) Not to describe itself as agent or representative or employee of NIIT;

(b) Not to make any representations or to give any warranties to the clients/customers of
NIIT, other than those specifically authorized by NIIT in writing;

(c) Not to delegate any duties or obligations arising under this Agreement otherwise than may
be expressly permitted under its terms or authorized by NIIT in writing

2. Nature of the Relationship between the Parties

2.1 It is agreed and understood between the Parties that :-

(a) NIIT shall not be liable for any claims or demands from any third party for any act done
by the Vendor whether in pursuance of this Agreement or otherwise;

(b) NIIT shall not be liable to compensate the Vendor for any loss, accident or injury
sustained by the Vendor on account of the performance of its obligations under the
Agreement;

3. Consideration Payable to the Vendor

3.1 In consideration of the performance by the Vendor of its obligations hereunder and providing
satisfactory Services as per the scope as outlined in clause no. 1.1 above, NIIT shall pay to

https://www.tecknowhive.com/Tecknowhive/Workflow/Agreement/PSP/PSPRegFacTemplate_V2.aspx?strMSAID=EjtFcbE9pOE=&flag=3 2/26

7/25/2018 AGREEMENT

the Vendor 49000 Rs. per Month of engagement . The fees are inclusive of all taxes,
including but not limited to sales tax, VAT, service tax, duties etc.

3.2 The consideration shall be payable by NIIT only upon the successful and proper provision of
the Services by the Vendor.

3.3 For the purpose of payment of the Consideration the Vendor shall raise an invoice in the
name of NIIT. NIIT shall, after verification and ascertaining the correctness of the statement
submitted by the Vendor, pay the consideration amount within a period of fifteen (15) days of
submission of the statement by the Vendor;

3.4 All payments of consideration by NIIT to the Vendor shall be subject to statutory deductions
required under the Laws of India, including any deductions as are required under the Laws of
India.

3.5 In case of dispute regarding any invoice submitted by Vendor, NIIT will notify the Vendor
immediately and Vendor will have to respond within 5 working days citing its reason regarding
the same. If no response is received within the stipulated time, it will be considered as
Vendor’s agreement to NIIT’s claim and hence NIIT will be liable to pay only the amount
suggested by NIIT

3.6 Payment by NIIT of the consideration amount to the Vendor in accordance with this Clause
shall be complete discharge to NIIT in respect thereof and in particular the Vendor shall not
be entitled to any other payments or amounts by way of additional fee, charges or otherwise
in respect or arising out of the Agreement or otherwise;

3.7 NIIT shall not be liable for payment of any taxes, levies, charges, cess and payments as they
may arise or fall due and are payable under the Laws of India in respect of the performance
by the Vendor of his /her obligations hereunder.

3.8 The consideration for supply of services shall be inclusive of all taxes or duties including but
not limited to the GST, Customs duties as may be imposed by the Government of India from
time to time.( “GST Act” shall mean and include Central Goods and Service Tax Act, 2017
(CGST Act), State Goods and Service Tax Act, 2017 (SGST), Integrated Goods and Service
Tax Act, 2017 (IGST), Union Territory Goods and Service Tax Act, 2017 (UTGST), Rules and
any other GST related legislation in India. 2.“GST” shall mean the applicable tax levied under
GST Act.

3.9 Vendor shall provide a proper invoice in the form and manner prescribed under GST Act

containing all the particulars mentioned therein.

1. The invoice raised by Vendor shall necessarily and at least mention the following

information:

S. No. Information to be provided

1 Name, address and GSTIN of the supplier

2 Date of its issue, Serial Number of invoice not exceeding 16 character

3 Name, address and GSTIN of NIIT Limited

4 Name and address of NIIT Limited and the address of delivery, along with the
name of State and its code

5 HSN code of goods or Accounting Code of services

6 Description of goods or services

7 Quantity in case of goods and unit or Unique Quantity Code thereof

8 Total value of supply of goods or services or both

9 Taxable value of supply of goods or services or both taking into account
discount or abatement, if any

10 Rate of tax (central tax, State tax, integrated tax, Union territory tax or cess)

11 Amount of tax charged in respect of taxable goods or services (central tax, State
tax, integrated tax, Union territory tax or cess)

12 Place of supply along with the name of State, in case of a supply in the course of

inter-State trade or commerce

13 Address of delivery where the same is different from the place of supply

14 Whether the tax is payable on reverse charge basis

15 Signature or digital signature of the supplier or his authorized representative

https://www.tecknowhive.com/Tecknowhive/Workflow/Agreement/PSP/PSPRegFacTemplate_V2.aspx?strMSAID=EjtFcbE9pOE=&flag=3 3/26

7/25/2018 AGREEMENT

3.10 In the event that the Vendor fails to provide the invoice in the form and manner prescribed
under the GST Act, or in case if the invoice does not mention the aforesaid items of
information, NIIT shall not be liable to make any payment against such invoice.

3.11 Each party agrees to do all acts, including, providing relevant documentation in such form
and manner as may be prescribed under the GST Act that may be necessary to enable or
assist other party to claim or verify any input tax credit, set off, rebate or refund in relation to
any GST payable under this Agreement or in respect of any supply made under this
Agreement.

3.12 Vendor shall provide an advance receipt voucher to NIIT in the form and manner prescribed
under the GST Act in case of receipt of advance against supply of services to the NIIT Group
Company.

3.13 Notwithstanding anything contained anywhere in the Agreement, in the event that the input
tax credit of the GST charged by Vendor is denied by the tax authorities to NIIT, NIIT shall be
entitled to recover the commensurate amount from the Vendor. In addition to the amount of
GST,NIIT shall also be entitled to recover interest at the rate of ____% and penalty, in case
imposed by the tax authorities, on NIIT.

3.14 Vendor shall be entitled for the payments on the below said items is subject to prior
payment approval from HO

(a) Any payment against time spent in TTTs. NIIT organizes TTTs time to time to enable
vendors to perform their role well and personal development of the vendor

(b) Any payment against calls organized by the supervisor/ HO related to job
briefing/Feedback sharing/Observations can’t be billed;

(c) Any local conveyance bill claim, if, vendor is suggested to report directly at other
centre/office within city/NCR

(d) Any admin work charges which are associated to the work like attendance in system,
maintaining student records etc.

(e) Any Expense claim against Training attended outside NIIT

4. Protection of Intellectual Property Rights of NIIT

4.1 Notwithstanding anything to the contrary herein contained, the engagement of the Vendor
pursuant to Clause 1.1 hereof is limited as stated therein and nothing herein contained shall
confer upon the Vendor any right or interest in the Intellectual Property Rights, the technical
know how, of NIIT beyond those that pertain specifically to use thereof for purposes providing
the Services. For the purpose of this Agreement the Intellectual Property Rights shall mean all
intellectual property rights owned at present or in the future to be owned by NIIT including
but not limited to trade marks, trade names, copyrights, marks, and designs whether
registered or not.

4.2 Except to the extent as is specifically required for the provision of the Services and agreed to
and authorized by NIIT is writing pursuant hereof, the Vendor disclaims any right or interest
in the technical know-how, the Intellectual Property Rights, or the goodwill of NIIT derived
there from. In relation to the technical know-how, Intellectual Property Rights, or goodwill of
NIIT howsoever derived including pursuant to this Agreement, the Vendor shall not:-

(a) assert any right in excess of those conferred pursuant hereunder, or

(b) question, dispute or otherwise assail the validity, right, title, interest of NIIT thereto, or 4/26

https://www.tecknowhive.com/Tecknowhive/Workflow/Agreement/PSP/PSPRegFacTemplate_V2.aspx?strMSAID=EjtFcbE9pOE=&flag=3

7/25/2018 AGREEMENT

(c) either directly or indirectly through any other business entities of whatever description
employ, claim, assert or holdout any intellectual property right similar to the Intellectual
Property Rights.

4.3 At all times during the term of the Agreement, the Vendor agrees and covenants with NIIT:-

(a) Not to cause or permit anything which may damage or endanger the Intellectual Property
Rights or other intellectual property of NIIT or NIIT 's title to it or assist or allow others to
do so;

(b) To notify NIIT of any suspected infringement of the Intellectual Property Rights or other
intellectual property of NIIT;

(c) To take such reasonable action as NIIT may direct at the expense of NIIT in relation to
such infringement;

(d) To compensate NIIT for any use by the Vendor of the Intellectual Property Rights
otherwise than in accordance with this Agreement;

(e) To indemnify NIIT for any liability incurred to third parties for any use of the Intellectual
Property Rights otherwise than in accordance with this Agreement

(f) On the expiry or termination of this Agreement forthwith to cease to use the Intellectual
Property Rights save as expressly authorized by NIIT in writing;

(g) Not to tamper with any markings or nameplates or other indication which may be placed
by NIIT on any of its courseware, manuals and/or materials;

(h) To hold any additional goodwill generated by the Vendor as bare trustee for NIIT.

4.4 Notwithstanding anything to the contrary herein contained, any violation or breach by the
Vendor of this Clause shall be deemed to be a material breach by the Vendor of terms of this
Agreement and shall entitle NIIT to forthwith terminate this Agreement.

4.5 For the purpose of this Article, Intellectual Property Rights shall include Intellectual Property
Rights of NIIT, its Clients, Service Provider and/or Principals.

5. Confidentiality

5.1 For the purposes of this Agreement confidential information shall mean any data, information,
or document (whether technical or commercial) relating to the activities, rights and
obligations of Parties pursuant hereunder recorded on paper, tape, disc or any mechanical or
electronic device as may be communicated by NIIT to the Vendor or any other oral or written
communication made by NIIT pursuant hereunder including all plans, designs, drawings,
material specifications, Manuals, Courseware, Methodologies, Presentations, know-how and
any other technical or commercial information or documents relating to any subject pursuant
hereunder which are delivered in whole or in part but excluding any information:-

(a) Which is or becomes available to the public other than by breach of this Agreement; or

(b) Which is in or comes into the possession of the Vendor prior to the date of execution
hereof and which was not or is not obtained under any obligation of confidentiality; or

(c) Which is required by law or appropriate regulatory authorities to be disclosed, provided
that the NIIT is notified of any such requirement at least five days prior to such disclosure
and the disclosure is limited to the minimum extent possible; or

(hereafter “Confidential Information”)

5.2 During the Term hereof and for a period of three years after the expiry or the termination of
this Agreement, the Vendor agrees to:-

https://www.tecknowhive.com/Tecknowhive/Workflow/Agreement/PSP/PSPRegFacTemplate_V2.aspx?strMSAID=EjtFcbE9pOE=&flag=3 5/26

7/25/2018 AGREEMENT

(i) Use all Confidential Information solely for the purpose and in accordance of this
Agreement;

(ii) Treat and hold as confidential (and not disclose or provide access to any third parties) all
Confidential Information ;

(iii) Furnish to NIIT, as soon as practicable following expiry or termination of this Agreement,
for whatever reason, as the case may be, any and all copies (in whatever form or
medium) of all Confidential Information then in the possession of the Vendor and destroy
any and all additional copies then in the possession of Vendor of such information and of
any analyses, compilations, studies or other documents prepared, in whole or in part, on
the basis thereof.

5.3 For the purpose of this Article, Confidential Information shall include Confidential Information
of NIIT, its Clients, Service Provider and/or Principals.

6. Non-compete

6.1 In consideration of the mutual premises, promises, covenants and agreements between
Parties pursuant hereof, the Vendor covenants, promises and undertakes that the Vendor
shall not, during the subsistence of the Term hereof and for a period of 1 (One) year from the
end of Term or the termination hereof, as the case may be, engage, directly or indirectly,
whether as owner or shareholder, in any business:-

(a) That is similar to the business carried out by the NIIT pursuant hereunder; or

(b) That involves solicitation or acceptance (either on his own account) or as agent of any
other person or as the customer of any person in respect of the business of NIIT pursuant
hereunder; or

(c) That involves inducing, soliciting or endeavoring to encourage any person who is an
employee of NIIT to leave the services or employment of NIIT; or

(d) That uses any trade mark, name or nomenclature used by NIIT at any time or any other
name that is intended or like to cause confusion with any name used by NIIT.

(e) That involves the provision of Services or services similar to the Services in respect to any
party.

6.2. The Vendor acknowledges that the provisions of the Clauses hereof under Article 6 are
reasonable and are entered into for the purpose the protecting the goodwill of NIIT and that
accordingly, these benefits hereof may be assigned by NIIT to its successor in title or interest
without the consent of the Vendor.

6.3. The Vendor agrees that any breach of the Vendor’s obligations hereunder, specifically under
Article 4, 5 & 6, shall cause an irreparable loss and injury to NIIT and NIIT shall be at liberty
to take whatever steps necessary to safeguard its interest which shall include approaching the
competent courts for injunctive relief to check any such breach on part of the Vendor.

6.4. Without prejudice what is contemplated under Clause 6.3, the Vendor agrees that, in case of
any breach of its obligations arising out of this Agreement NIIT shall be entitled to recover the
liquidated damages of Rs.5,00,000 (Rupees Five Lakhs only) from the Vendor .

7. Term and Termination

7.1 The Agreement shall be effective for a period of 2 Month commencing from the date of 6/26
execution hereof (hereinbefore and hereinafter the “Term”), and shall automatically stand
terminated by efflux of time unless specifically extended in writing by NIIT prior to the expiry
of the Term. In the event that the Vendor is desirous of renewal of the Agreement beyond its

https://www.tecknowhive.com/Tecknowhive/Workflow/Agreement/PSP/PSPRegFacTemplate_V2.aspx?strMSAID=EjtFcbE9pOE=&flag=3

7/25/2018 AGREEMENT

initial term, the Vendor shall notify NIIT of its intention to do so within a period of at least
one-month before the end of the initial term of the Agreement. Upon receiving such
notification from the Vendor, NIIT may at its sole option and discretion agree to extend the
Agreement beyond its initial Term. In the event that NIIT exercises its option to renew this
Agreement, NIIT shall notify the Vendor of its intention to do so within a period of at least 15
days before the end of the initial terms of this Agreement.

7.2 Any Party may at any time during the Term hereof and without assigning any reason
whatsoever, terminate the Agreement by issuing to other Party a written Notice, at least 15
days in advance notwithstanding anything contained herein above.

7.3 NIIT shall have the right to terminate this Agreement forthwith on the happening of any of
the following events:
(a) any breach by the Vendor of any of its obligations set out in this agreement; or

(b) the commission or omission by the Vendor of any act which brings disrepute to or is not in
the best business interest of NIIT;

(c) assignment by the Vendor of its obligation hereunder to any other third party without
taking prior consent of NIIT;

(d) failure by the Vendor to perform its obligations under this Agreement through incapacity
or due to any other reasons. Or

(e) failure by the Vendor to provide the Services to the complete satisfaction of NIIT;

7.4 Upon the expiry of the Term or on termination of the Agreement in accordance hereof:
(a) Parties shall have no rights under this Agreements and be relieved and discharged from all
other liabilities, obligations or claims hereunder except such liabilities and rights as have
accrued prior to termination or are intended by the terms hereof to survive termination;

(b) The Vendor shall deliver back to NIIT all materials belonging to NIIT which are in the
possession of the Vendor;

(c) The Vendor shall forthwith cease to use the Intellectual Property Rights of NIIT and shall
sign such confirmation/undertaking of cessation of use of Intellectual Property Rights as
NIIT may require;

(d) The Vendor shall return to NIIT all originals and copies of all documents and information
in any form, containing or covering in any way any part of the Intellectual Property
Rights;

(e) The Vendor shall furnish to NIIT, any and all copies of all Confidential Information then in
the possession of the Vendor and destroy any and all additional copies thereof, and of any
analyses, compilations, studies or other documents prepared, in whole or in part, on the
basis of such Confidential Information;

(f) The Vendor shall continue to abide by such terms of the Agreement that are intended to
survive its Term or termination.

(g) The company can notify any future or prospective employer or third party of the existence
of this agreement, and shall be entitled to full injunctive relief for any breach.

(h) This agreement shall be binding upon the Vendor, his personal representatives and
successors in interest, and shall inure to the benefit of the company, its successors and
assigns.

8. Indemnity

8.1 At all times during and after the Term, the Vendor agrees to indemnify, defend and hold
harmless (i) NIIT, (ii) each of NIIT’s Affiliates, assigns and successors in interest, as the case
may be; and (iii) each of the respective directors, officers and employees of NIIT from and
against any and all losses which may be incurred or suffered by any such party and which

https://www.tecknowhive.com/Tecknowhive/Workflow/Agreement/PSP/PSPRegFacTemplate_V2.aspx?strMSAID=EjtFcbE9pOE=&flag=3 7/26

7/25/2018 AGREEMENT

may arise out of or result from:

(a) any breach of any warranties, obligations, covenants or agreement of the Vendor
contained in this Agreement;

(b) any third party claims made for loss or damage of whatever description caused to such or
any other third party as a result of the activities under this Agreement and the Services
provided by the Vendor under the terms hereof and the liability of the Vendor against the
said loss or damages shall be unlimited;

(c) from all losses, cost, claims and expenses on account of any shortcoming including
mistake, negligence etc. on the part of the Vendor in discharge of their various duties and
responsibilities; and

(d) any and all actions, suits, proceedings, claims, judgments, cost, expenses, including
incurred in enforcing this indemnity.

9. Limitation of Liability

9.1 It is agreed between the Parties that NIIT shall not bear any damage, expense, and insurance
cost of the Vendor, other than what is agreed as consideration payable to the Vendor.

9.2 NIIT shall not be responsible for any liability created by the Vendor to any third party in the
course of providing Services.

10. Miscellaneous Provisions

10.1 Amendment

This Agreement may not be amended or modified except by an instrument in writing signed by, or on
behalf of, NIIT and the Vendor.

10.2 Assignment

The Vendor shall not assign or sub-contract this Agreement or of any of its rights or obligations hereunder
in whole or in part without the prior written consent of NIIT. Any assignment or sub-contract of the
Agreement or any of the rights or obligations hereof contrary to this Article shall render the Agreement null
and void.

10.3 No Partnership/Agency

Nothing in the Agreement shall be construed as creating an agency, partnership or joint venture between
NIIT and the Vendor. Subject to the provisions hereof, neither Party will be deemed to be an agent of the
other Party as a result of any transaction under or related to the Agreement, and will not in any way
pledge the other Party’s credit or incur any obligation on behalf of the other Party except with prior written
consent of the other Party.

10.4 Waiver

NIIT may (a) extend the time for performance of any of the obligations or other acts of the Vendor, (b)
waive any inaccuracies in the representations and warranties of the Vendor contained herein or in any
document delivered by the Vendor pursuant hereto or (c) waive compliance with any of the clauses of the
Agreement. Any such extension or waiver shall be valid only if set forth in an instrument in writing signed
by NIIT to be bound thereby. Any waiver of any term or condition shall not be construed as a waiver of
any subsequent breach or a subsequent waiver of the same term or condition, or a waiver of any other
term or condition, of this Agreement. The failure of NIIT to assert any of its rights hereunder shall not
constitute a waiver of any such rights.

10.5 Notice

https://www.tecknowhive.com/Tecknowhive/Workflow/Agreement/PSP/PSPRegFacTemplate_V2.aspx?strMSAID=EjtFcbE9pOE=&flag=3 8/26

7/25/2018 AGREEMENT

Any Notice, under or in connection hereof shall be written in English and be sent by hand delivery, courier
or prepaid registered post at the Notice Address.

For the purpose of this clause, Notice Address means,

Authorized signatory name : Venkata Durga Ravi K

In the case of NIIT Ltd.:

The President,
8, Balaji Estate, First Floor,
Guru Ravi Das Marg, Kalkaji
New Delhi - 110019;

In the case of the Vendor:

RANGANATHAN CHANDRASEKARAN

CHENNAI

10.6 Data Protection:

Notwithstanding anything contrary stated elsewhere in this Agreement, the Vendor agrees to
keep the personal data pertaining to NIIT and its customers and its and their personnel
(Personal Data) confidential, and agrees not to disclose the same or any part of it to third
parties without having received prior written consent of NIIT. The Vendor agrees to maintain
safeguards and take technical precautions to protect Personal Data against unauthorized access,
damage, use, modification, disclosure or impairment by third parties while in possession or
under the control of the Vendor. The Personal Data will not be (a) used by the Vendor other
than in providing services under this Agreement; (b) sold, assigned or otherwise provided to
third parties by the Vendor; and (c) commercially exploited by the Vendor. In case the Vendor is
negligent in complying with this clause and thereby causes wrongful loss or wrongful gain to any
person, the Vendor shall be liable to pay damages by way of compensation to the person so
affected. The non-compliance of this Clause will be considered as material breach of this
Agreement.

10.7 Arbitration

All disputes and differences of whatsoever nature arising out of this Agreement, whether during
its term or after expiry thereof or in connection with any question regarding its existence,
validity or termination, shall be referred to and finally resolved by arbitration under the
provisions of the Arbitration and Conciliation Act, 1996 by a sole arbitrator (to be appointed by
the Parties upon mutual consent) whose decision shall be final on every matter arising
hereunder. The venue of the arbitration shall preferably be in New Delhi and the language for
the arbitration proceedings shall be in English only. The Parties shall share all costs and
expenses of such proceedings proportionately.

10.8 Severability

In the event where any of the provisions, or portions or applications thereof, of this Agreement
are held to be unenforceable or invalid by any court of competent jurisdiction NIIT and the
Vendor shall mutually agree upon a reasonable adjustment in such provisions of this Agreement
with a view toward effecting the purpose of such provisions of this Agreement, and the validity
and enforceability of the remaining provisions, or portion or applications thereof, shall not be
affected thereby.

10.9 Governing Law and Jurisdiction

The validity, the performance and the interpretation of this Agreement and all actions related
hereto shall be governed by the Laws of India and Courts of Delhi shall have exclusive
jurisdiction in respect of any matters arising under or in relation to this Agreement.

https://www.tecknowhive.com/Tecknowhive/Workflow/Agreement/PSP/PSPRegFacTemplate_V2.aspx?strMSAID=EjtFcbE9pOE=&flag=3 9/26

7/25/2018 AGREEMENT

IN WITNESS WHEREOF the Parties hereto have executed these presents on the day, month and year first above
written.

Witnesses:

For NIIT Ltd. :-

1. ……………………………………………………………………………………………………………… 2.
………………………………………………………………………………………………………………

For Vendor :-

1. ……………………………………………………………………………………………………………… 2.
………………………………………………………………………………………………………………

Addendum to the Agreement

The terms used in this Addendum shall have the meanings set forth in this Addendum. Capitalized terms not
otherwise defined herein shall have the meaning given to them in the Principal Agreement. Except as modified
below, the terms of the Principal Agreement shall remain in full force and effect.

In consideration of the mutual obligations set out herein, the parties hereby agree that the terms and
conditions set out below shall be added to the Principal Agreement as an Addendum. Except where the context
requires otherwise, references in this Addendum to the Principal Agreement are to the Principal Agreement as
amended by, and including, this Addendum.

1. Definitions

1.1 In this Addendum, the following terms shall have the meanings set out below and cognate terms shall be
construed accordingly:

1.1.1 Applicable Laws means

(a) European Union or Member State laws with respect to any Company Personal Data in
respect of which any Company Group Member is subject to EU Data Protection Laws; and

(b) any other applicable law with respect to any Company Personal Data in respect of which
any Company Group Member is subject to any other Data Protection Laws;

1.1.2 Company Affiliate means

an entity that owns or controls, is owned or controlled by or is or under common control or
ownership with Company, where control is defined as the possession, directly or indirectly, of
the power to direct or cause the direction of the management and policies of an entity, whether
through ownership of voting securities, by contract or otherwise;

1.1.3 Company Group Member means

Company or any Company Affiliate;

1.1.4 Company Personal Data means

any Personal Data Processed by a Contracted Processor on behalf of a Company Group Member
pursuant to or in connection with the Principal Agreement;

1.1.5 Contracted Processor means

Vendor or a Sub processor;

1.1.6 Data Protection Laws means 10/26

https://www.tecknowhive.com/Tecknowhive/Workflow/Agreement/PSP/PSPRegFacTemplate_V2.aspx?strMSAID=EjtFcbE9pOE=&flag=3

7/25/2018 AGREEMENT

EU Data Protection Laws and, to the extent applicable, the data protection or privacy laws of
any other country;

1.1.7 EEA means

the European Economic Area;

1.1.8 EU Data Protection Laws means

EU Directive 95/46/EC, as transposed into domestic legislation of each Member State and as
amended, replaced or superseded from time to time, including by the GDPR and laws
implementing or supplementing the GDPR;

1.1.9 GDPR means

the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016
on the protection of natural persons with regard to the processing of personal data and on the
free movement of such data, and repealing Directive 95/46/EC (General Data Protection
Regulation);

1.1.10 Restricted Transfer means:

1.1.10.1 a transfer of Company Personal Data from any Company Group Member to a
Contracted Processor; ora Contracted Processor; or

1.1.10.2 an onward transfer of Company Personal Data from a Contracted Processor to a
Contracted Processor, or between two establishments of a Contracted Processor,

in each case, where such transfer would be prohibited by Data Protection Laws (or by the
terms of data transfer agreements put in place to address the data transfer restrictions of Data
Protection Laws) in the absence of the Standard Contractual Clauses to be established under
section [6.4.3 or] 12 below;

1.1.11 Services means

the services and other activities to be supplied to or carried out by or on behalf of Vendor for
Company Group Members pursuant to the Principal Agreement;

1.1.12 Standard Contractual Clauses means

the contractual clauses set out in Annex 2, amended as indicated (in square brackets and
italics) in that Annex and under section 13.4;

1.1.13 Sub processor means

any person (including any third party and any Vendor Affiliate, but excluding an employee of
Vendor or any of its sub-contractors) appointed by or on behalf of Vendor or any Vendor
Affiliate to Process Personal Data on behalf of any Company Group Member in connection with
the Principal Agreement; and

1.1.14 Supervisory Authority means

an independent public authority which is established by an EU Member State pursuant to the
GDPR.

1.1.15 Vendor Affiliate means

an entity that owns or controls, is owned or controlled by or is or under common control or
ownership with Vendor, where control is defined as the possession, directly or indirectly, of the
power to direct or cause the direction of the management and policies of an entity, whether
through ownership of voting securities, by contract or otherwise.

1.2 The terms, Commission, Controller, Data Subject, Member State, Personal Data, Personal Data Breach 11/26

https://www.tecknowhive.com/Tecknowhive/Workflow/Agreement/PSP/PSPRegFacTemplate_V2.aspx?strMSAID=EjtFcbE9pOE=&flag=3

7/25/2018 AGREEMENT

and Processing shall have the same meaning as in the GDPR, and their cognate terms shall be construed
accordingly.

1.3 The word include shall be construed to mean include without limitation, and cognate terms shall be
construed accordingly.

2. Authority

Vendor warrants and represents that, before any Vendor Affiliate Processes any Company Personal Data
on behalf of any Company Group Member, Vendor's entry into this Addendum as agent for and on behalf
of that Vendor Affiliate will have been duly and effectively authorised (or subsequently ratified) by that
Vendor Affiliate.

3. Processing of Company Personal Data
3.1 Vendor and each Vendor Affiliate shall:

3.1.1 comply with all applicable Data Protection Laws in the Processing of Company Personal Data;
and

3.1.2 not Process Company Personal Data other than on the relevant Company Group Member’s
documented instructions unless Processing is required by Applicable Laws to which the relevant
Contracted Processor is subject, in which case Vendor or the relevant Vendor Affiliate shall to
the extent permitted by Applicable Laws inform the relevant Company Group Member of that
legal requirement before the relevant Processing of that Personal Data.

3.2 Each Company Group Member:

3.2.1 instructs Vendor and each Vendor Affiliate (and authorises Vendor and each Vendor Affiliate to
instruct each Sub processor) to:

3.2.1.1 Process Company Personal Data; and

3.2.1.2 in particular, transfer Company Personal Data to any country or territory, as
reasonably necessary for the provision of the Services and consistent with the
Principal Agreement; and

3.2.2 warrants and represents that it is and will at all relevant times remain duly and effectively
authorised to give the instruction set out in section 3.2.1 on behalf of each relevant Company
Affiliate.

3.3 Annex 1 to this Addendum sets out certain information regarding the Contracted Processors' Processing
of the Company Personal Data as required by article 28(3) of the GDPR (and, possibly, equivalent
requirements of other Data Protection Laws). Company may make reasonable amendments to Annex 1
by written notice to Vendor from time to time as Company reasonably considers necessary to meet those
requirements. Nothing in Annex 1 (including as amended pursuant to this section 3.3) confers any right
or imposes any obligation on any party to this Addendum.

4. Vendor and Vendor Affiliate Personnel

Vendor and each Vendor Affiliate shall take reasonable steps to ensure the reliability of any employee,
agent or contractor of any Contracted Processor who may have access to the Company Personal Data,
ensuring in each case that access is strictly limited to those individuals who need to know / access the
relevant Company Personal Data, as strictly necessary for the purposes of the Principal Agreement, and
to comply with Applicable Laws in the context of that individual's duties to the Contracted Processor,
ensuring that all such individuals are subject to confidentiality undertakings or professional or statutory
obligations of confidentiality.

5. Security

5.1 Taking into account the state of the art, the costs of implementation and the nature, scope, context and 12/26
purposes of Processing as well as the risk of varying likelihood and severity for the rights and freedoms
of natural persons, Vendor and each Vendor Affiliate shall in relation to the Company Personal Data

https://www.tecknowhive.com/Tecknowhive/Workflow/Agreement/PSP/PSPRegFacTemplate_V2.aspx?strMSAID=EjtFcbE9pOE=&flag=3

7/25/2018 AGREEMENT

implement appropriate technical and organizational measures to ensure a level of security appropriate to
that risk, including, as appropriate, the measures referred to in Article 32(1) of the GDPR.

5.2 In assessing the appropriate level of security, Vendor and each Vendor Affiliate shall take account in
particular of the risks that are presented by Processing, in particular from a Personal Data Breach.

6. Sub processing

6.1 Each Company Group Member authorises Vendor and each Vendor Affiliate to appoint (and permit each
Sub processor appointed in accordance with this section 6 to appoint) Sub processors in accordance with
this section 6 and any restrictions in the Principal Agreement.

6.2 Vendor and each Vendor Affiliate may continue to use those Subprocessors already engaged by Vendor
or any Vendor Affiliate as at the date of this Addendum, subject to Vendor and each Vendor Affiliate in
each case as soon as practicable meeting the obligations set out in section 6.4.

6.3 Vendor shall give Company prior written notice of the appointment of any new Subprocessor, including
full details of the Processing to be undertaken by the Subprocessor. If, within [ ] of receipt of that notice,
Company notifies Vendor in writing of any objections (on reasonable grounds) to the proposed
appointment:

Alternative A:

[Neither Vendor nor any Vendor Affiliate shall appoint (or disclose any Company Personal Data to) that
proposed Sub processor until reasonable steps have been taken to address the objections raised by any
Company Group Member and Company has been provided with a reasonable written explanation of the
steps taken.] Alternative B:

Alternative B:

6.3.1 [Vendor shall work with Company in good faith to make available a commercially reasonable
6.3.2 change in the provision of the Services which avoids the use of that proposed Subprocessor;
and

where such a change cannot be made within [ ] from Vendor's receipt of Company's notice,
notwithstanding anything in the Principal Agreement, Company may by written notice to
Vendor with immediate effect terminate the Principal Agreement to the extent that it relates
to the Services which require the use of the proposed Subprocessor.]

Alternative c:

[Neither Vendor nor any Vendor Affiliate shall appoint (nor disclose any Company Personal Data to) the
proposed Sub processor except with the prior written consent of Company.]

6.4 With respect to each Sub processor, Vendor or the relevant Vendor Affiliate shall:

6.4.1 before the Sub processor first Processes Company Personal Data (or, where relevant, in
accordance with section 6.2), carry out adequate due diligence to ensure that the Sub
processor is capable of providing the level of protection for Company Personal Data required by
the Principal Agreement;

6.4.2 ensure that the arrangement between on the one hand (a) Vendor, or (b) the relevant Vendor
Affiliate, or (c) the relevant intermediate Sub processor; and on the other hand the
Subprocessor, is governed by a written contract including terms which offer at least the same
level of protection for Company Personal Data as those set out in this Addendum and meet the
requirements of article 28(3) of the GDPR;

6.4.3 if that arrangement involves a Restricted Transfer, ensure that the Standard Contractual 13/26
Clauses are at all relevant times incorporated into the agreement between on the one hand (a)
Vendor, or (b) the relevant Vendor Affiliate, or (c) the relevant intermediate Sub processor;
and on the other hand the Sub processor, or before the Sub processor first Processes Company
Personal Data procure that it enters into an agreement incorporating the Standard Contractual
Clauses with the relevant Company Group Member(s) (and Company shall procure that each
Company Affiliate party to any such Standard Contractual Clauses co-operates with their
population and execution); and

https://www.tecknowhive.com/Tecknowhive/Workflow/Agreement/PSP/PSPRegFacTemplate_V2.aspx?strMSAID=EjtFcbE9pOE=&flag=3

7/25/2018 AGREEMENT

6.4.4 provide to Company for review such copies of the Contracted Processors' agreements with
Subprocessors (which may be redacted to remove confidential commercial information not
relevant to the requirements of this Addendum) as Company may request from time to time.

7. Data Subject Rights

7.1 Taking into account the nature of the Processing, Vendor and each Vendor Affiliate shall assist each
Company Group Member by implementing appropriate technical and organisational measures, insofar as
this is possible, for the fulfilment of the Company Group Members' obligations, as reasonably understood
by Company, to respond to requests to exercise Data Subject rights under the Data Protection Laws.

7.2 Vendor shall:

7.2.1 promptly notify Company if any Contracted Processor receives a request from a Data Subject
under any Data Protection Law in respect of Company Personal Data; and

7.2.2 ensure that the Contracted Processor does not respond to that request except on the
documented instructions of Company or the relevant Company Affiliate or as required by
Applicable Laws to which the Contracted Processor is subject, in which case Vendor shall to the
extent permitted by Applicable Laws inform Company of that legal requirement before the
Contracted Processor responds to the request.

8. Personal Data Breach

8.1 Vendor shall notify Company without undue delay upon Vendor or any Sub processor becoming aware of
a Personal Data Breach affecting Company Personal Data, providing Company with sufficient information
to allow each Company Group Member to meet any obligations to report or inform Data Subjects of the
Personal Data Breach under the Data Protection Laws. Any Information security and data privacy breach
to be notify at [email protected] Immediately.

8.2 Vendor shall co-operate with Company and each Company Group Member and take such reasonable
commercial steps as are directed by Company to assist in the investigation, mitigation and remediation
of each such Personal Data Breach

9. Data Protection Impact Assessment and Prior Consultation

Vendor and each Vendor Affiliate shall provide reasonable assistance to each Company Group Member
with any data protection impact assessments, and prior consultations with Supervising Authorities or
other competent data privacy authorities, which Company reasonably considers to be required of any
Company Group Member by article 35 or 36 of the GDPR or equivalent provisions of any other Data
Protection Law, in each case solely in relation to Processing of Company Personal Data by, and taking
into account the nature of the Processing and information available to, the Contracted Processors.

10. Deletion or return of Company Personal Data

10.1 Subject to sections 10.2 and 10.3 Vendor and each Vendor Affiliate shall promptly and in any event
within [ ] of the date of cessation of any Services involving the Processing of Company Personal Data
(the Cessation Date), delete and procure the deletion of all copies of those Company Personal Data.

10.2 Subject to section 10.3, Company may in its absolute discretion by written notice to Vendor within [ ] of
the Cessation Date require Vendor and each Vendor Affiliate to (a) return a complete copy of all
Company Personal Data to Company by secure file transfer in such format as is reasonably notified by
Company to Vendor; and (b) delete and procure the deletion of all other copies of Company Personal
Data Processed by any Contracted Processor. Vendor and each Vendor Affiliate shall comply with any
such written request within [ ] of the Cessation Date.

10.3 Each Contracted Processor may retain Company Personal Data to the extent required by Applicable Laws
and only to the extent and for such period as required by Applicable Laws and always provided that
Vendor and each Vendor Affiliate shall ensure the confidentiality of all such Company Personal Data and
shall ensure that such Company Personal Data is only Processed as necessary for the purpose(s)
specified in the Applicable Laws requiring its storage and for no other purpose.

10.4 Vendor shall provide written certification to Company that it and each Vendor Affiliate has fully complied
with this section 10 within [ ] of the Cessation Date.

https://www.tecknowhive.com/Tecknowhive/Workflow/Agreement/PSP/PSPRegFacTemplate_V2.aspx?strMSAID=EjtFcbE9pOE=&flag=3 14/26

7/25/2018 AGREEMENT

11. Audit rights

11.1 Subject to sections [11.2 to 11.4], Vendor and each Vendor Affiliate shall make available to each
Company Group Member on request all information necessary to demonstrate compliance with this
Addendum, and shall allow for and contribute to audits, including inspections, by any Company Group
Member or an auditor mandated by any Company Group Member in relation to the Processing of the
Company Personal Data by the Contracted Processors.

11.2 Information and audit rights of the Company Group Members only arise under section 11.1 to the extent
that the Principal Agreement does not otherwise give them information and audit rights meeting the
relevant requirements of Data Protection Law (including, where applicable, article 28(3)(h) of the GDPR).

11.3 [Company or the relevant Company Affiliate undertaking an audit shall give Vendor or the relevant
Vendor Affiliate reasonable notice of any audit or inspection to be conducted under section 11.1 and
shall make (and ensure that each of its mandated auditors makes) reasonable endeavours to avoid
causing (or, if it cannot avoid, to minimise) any damage, injury or disruption to the Contracted
Processors' premises, equipment, personnel and business while its personnel are on those premises in
the course of such an audit or inspection. A Contracted Processor need not give access to its premises
for the purposes of such an audit or inspection:

11.3.1 to any individual unless he or she produces reasonable evidence of identity and authority;

11.3.2 outside normal business hours at those premises, unless the audit or inspection needs to be
conducted on an emergency basis and Company or the relevant Company Affiilate undertaking
an audit has given notice to Vendor or the relevant Vendor Affiliate that this is the case before
attendance outside those hours begins; or

11.3.3 for the purposes of more than [one] audit or inspection, in respect of each Contracted
Processor, in any [calendar year], except for any additional audits or inspections which:

11.3.3.1 Company or the relevant Company Affiliate undertaking an audit reasonably
considers necessary because of genuine concerns as to Vendor's or the relevant
Vendor Affiliate’s compliance with this Addendum; or

11.3.3.2 A Company Group Member is required or requested to carry out by Data Protection
Law, a Supervisory Authority or any similar regulatory authority responsible for the
enforcement of Data Protection Laws in any country or territory,

where Company or the relevant Company Affiliate undertaking an audit has identified its
concerns or the relevant requirement or request in its notice to Vendor or the relevant Vendor
Affiliate of the audit or inspection.]

12. Restricted Transfers

12.1 Subject to section 12.3, each Company Group Member (as "data exporter") and each Contracted
Processor, as appropriate, (as "data importer") hereby enter into the Standard Contractual Clauses in
respect of any Restricted Transfer from that Company Group Member to that Contracted Processor.

12.2 The Standard Contractual Clauses shall come into effect under section 12.1 on the later of:

12.2.1 the data exporter becoming a party to them;

12.2.2 the data importer becoming a party to them; and

12.2.3 commencement of the relevant Restricted Transfer

12.3 Section 12.1 shall not apply to a Restricted Transfer unless its effect, together with other reasonably
practicable compliance steps (which, for the avoidance of doubt, do not include obtaining consents from
Data Subjects), is to allow the relevant Restricted Transfer to take place without breach of applicable
Data Protection Law.

12.4 [Vendor warrants and represents that, before the commencement of any Restricted Transfer to a Sub 15/26
processor which is not a Vendor Affiliate, Vendor's or the relevant Vendor Affiliate’s entry into the

https://www.tecknowhive.com/Tecknowhive/Workflow/Agreement/PSP/PSPRegFacTemplate_V2.aspx?strMSAID=EjtFcbE9pOE=&flag=3

7/25/2018 AGREEMENT

Standard Contractual Clauses under section 12.1, and agreement to variations to those Standard
Contractual Clauses made under section 13.4.1, as agent for and on behalf of that Sub processor will
have been duly and effectively authorised (or subsequently ratified) by that Sub processor.]

13. General Terms

Governing law and jurisdiction

13.1.1 the parties to this Addendum hereby submit to the choice of jurisdiction stipulated in the
Principal Agreement with respect to any disputes or claims howsoever arising under this
Addendum, including disputes regarding its existence, validity or termination or the
consequences of its nullity; and

13.1.2 this Addendum and all non-contractual or other obligations arising out of or in connection with it
are governed by the laws of the country or territory stipulated for this purpose in the Principal
Agreement.

Order of precedence

13.2 Nothing in this Addendum reduces Vendor's or any Vendor Affiliate’s obligations under the Principal
Agreement in relation to the protection of Personal Data or permits Vendor or any Vendor Affiliate to
Process (or permit the Processing of) Personal Data in a manner which is prohibited by the Principal
Agreement. In the event of any conflict or inconsistency between this Addendum and the Standard
Contractual Clauses, the Standard Contractual Clauses shall prevail.

13.3 Subject to section 13.2, with regard to the subject matter of this Addendum, in the event of
inconsistencies between the provisions of this Addendum and any other agreements between the
parties, including the Principal Agreement and including (except where explicitly agreed otherwise in
writing, signed on behalf of the parties) agreements entered into or purported to be entered into after
the date of this Addendum, the provisions of this Addendum shall prevail.

Changes in Data Protection Laws, etc.
13.4 Company may:

13.4.1 by at least [30 (thirty) calendar days'] written notice to Vendor from time to time make any
variations to the Standard Contractual Clauses (including any Standard Contractual Clauses
entered into under section 12.1), as they apply to Restricted Transfers which are subject to a
particular Data Protection Law, which are required, as a result of any change in, or decision of
a competent authority under, that Data Protection Law, to allow those Restricted Transfers to
be made (or continue to be made) without breach of that Data Protection Law; and

13.4.2 propose any other variations to this Addendum which Company reasonably considers to be
necessary to address the requirements of any Data Protection Law.

13.5 If Company gives notice under section 13.4.1:

13.5.1 [Vendor and each Vendor Affiliate shall promptly co-operate (and ensure that any affected
Subprocessors promptly co-operate) to ensure that equivalent variations are made to any
agreement put in place under section 6.4.3; and]

13.5.2 Company shall not unreasonably withhold or delay agreement to any consequential variations
to this Addendum proposed by Vendor to protect the Contracted Processors against additional
risks associated with the variations made under section 13.4.1 [and/or 13.5.1].

13.6 If Company gives notice under section 13.4.2, the parties shall promptly discuss the proposed variations
and negotiate in good faith with a view to agreeing and implementing those or alternative variations
designed to address the requirements identified in Company's notice as soon as is reasonably
practicable.

13.7 Neither Company nor Vendor shall require the consent or approval of any Company Affiliate or Vendor
Affiliate to amend this Addendum pursuant to this section 13.5 or otherwise.

https://www.tecknowhive.com/Tecknowhive/Workflow/Agreement/PSP/PSPRegFacTemplate_V2.aspx?strMSAID=EjtFcbE9pOE=&flag=3 16/26

7/25/2018 AGREEMENT

Severance
13.8 Should any provision of this Addendum be invalid or unenforceable, then the remainder of this

Addendum shall remain valid and in force. The invalid or unenforceable provision shall be either (i)
amended as necessary to ensure its validity and enforceability, while preserving the parties’ intentions
as closely as possible or, if this is not possible, (ii) construed in a manner as if the invalid or
unenforceable part had never been contained therein.

IN WITNESS WHEREOF, this Addendum is entered into and becomes a binding part of the Principal Agreement
with effect from the date first set out above.
[NIIT LTD]

Signature ______________________________

Name ________________________________

Title __________________________________

Date Signed ____________________________
[Vendor]

Signature ______________________________

Name _________________________________

Title __________________________________

Date Signed ____________________________

ANNEX 1: DETAILS OF PROCESSING OF COMPANY PERSONAL DATA

This Annex 1 includes certain details of the Processing of Company Personal Data as required by Article 28(3)
GDPR.

Subject matter and duration of the Processing of Company Personal Data

The subject matter and duration of the Processing of the Company Personal Data are set out in the Principal
Agreement and this Addendum.

The nature and purpose of the Processing of Company Personal Data

[Include descripti[Include description here]

The types of Company Personal Data to be Processed

[Include list of data types here]

The categories of Data Subject to whom the Company Personal Data relates

[Include categories of data subjects here]

The obligations and rights of Company and Company Affiliates

The obligations and rights of Company and Company Affiliates are set out in the Principal Agreement and this
Addendum.

ANNEX 2: STANDARD CONTRACTUAL CLAUSES

[These Clauses are deemed to be amended from time to time, to the extent that they relate to a Restricted 17/26
Transfer which is subject to the Data Protection Laws of a given country or territory, to reflect (to the extent
possible without material uncertainty as to the result) any change (including any replacement) made in
accordance with those Data Protection Laws (i) by the Commission to or of the equivalent contractual clauses

https://www.tecknowhive.com/Tecknowhive/Workflow/Agreement/PSP/PSPRegFacTemplate_V2.aspx?strMSAID=EjtFcbE9pOE=&flag=3

7/25/2018 AGREEMENT

approved by the Commission under EU Directive 95/46/EC or the GDPR (in the case of the Data Protection
Laws of the European Union or a Member State); or (ii) by an equivalent competent authority to or of any
equivalent contractual clauses approved by it or by another competent authority under another Data Protection
Law (otherwise).]

[If these Clauses are not governed by the law of a Member State, the terms "Member State" and "State" are
replaced, throughout, by the word "jurisdiction".]

Standard Contractual Clauses (processors)

For the purposes of Article 26(2) of Directive 95/46/EC for the transfer of personal data to processors
established in third countries which do not ensure an adequate level of data protection [This opening recital is
deleted if these Clauses are not governed by the law of a member state of the EEA.]

[The gaps below are populated with details of the relevant Company Group Member:]

Name of the data exporting organisation:

Address: NIIT LTD

Tel.: ____________; fax: __________________; e-mail: __________________

Other information needed to identify the organisation

……………………………………………………………
(the data exporter)

VENDOR And
[The gaps below are populated with details of the relevant Contracted Processor:]

Name of the data importing organisation:

Address:

Tel.: ________________; fax: _________________; e-mail:__________________

Other information needed to identify the organisation:

…………………………………………………………………
(the data importer)

each a “party”; together “the parties”,

HAVE AGREED on the following Contractual Clauses (the Clauses) in order to adduce adequate safeguards with
respect to the protection of privacy and fundamental rights and freedoms of individuals for the transfer by the
data exporter to the data importer of the personal data specified in Appendix 1.

Background

The data exporter has entered into a data processing addendum (“DPA”) with the data importer. Pursuant to
the terms of the DPA, it is contemplated that services provided by the data importer will involve the transfer of
personal data to data importer. Data importer is located in a country not ensuring an adequate level of data
protection. To ensure compliance with Directive 95/46/EC and applicable data protection law, the controller
agrees to the provision of such Services, including the processing of personal data incidental thereto, subject
to the data importer’s execution of, and compliance with, the terms of these Clauses.

Clause 1
Definitions

For the purposes of the Clauses:

(a) 'personal data', 'special categories of data', 'process/processing', 'controller', 'processor', 'data subject' 18/26
and 'supervisory authority' shall have the same meaning as in Directive 95/46/EC of the European

https://www.tecknowhive.com/Tecknowhive/Workflow/Agreement/PSP/PSPRegFacTemplate_V2.aspx?strMSAID=EjtFcbE9pOE=&flag=3

7/25/2018 AGREEMENT

Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the
processing of personal data and on the free movement of such data; [If these Clauses are governed by
a law which extends the protection of data protection laws to corporate persons, the words “except
that, if these Clauses govern a transfer of data relating to identified or identifiable corporate (as well as
natural) persons, the definition of "personal data" is expanded to include those data” are added.]

(b) 'the data exporter' means the controller who transfers the personal data;

(c) 'the data importer' means the processor who agrees to receive from the data exporter personal data
intended for processing on his behalf after the transfer in accordance with his instructions and the
terms of the Clauses and who is not subject to a third country's system ensuring adequate protection
within the meaning of Article 25(1) of Directive 95/46/EC; [If these Clauses are not governed by the
law of a Member State, the words "and who is not subject to a third country's system ensuring
adequate protection within the meaning of Article 25(1) of Directive 95/46/EC" are deleted.]

(d) the sub processor means any processor engaged by the data importer or by any other sub processor of
the data importer who agrees to receive from the data importer or from any other sub processor of the
data importer personal data exclusively intended for processing activities to be carried out on behalf of
the data exporter after the transfer in accordance with his instructions, the terms of the Clauses and
the terms of the written subcontract;

(e) the applicable data protection law means the legislation protecting the fundamental rights and freedoms
of individuals and, in particular, their right to privacy with respect to the processing of personal data
applicable to a data controller in the Member State in which the data exporter is established;

(f) technical and organisational security measures means those measures aimed at protecting personal
data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or
access, in particular where the processing involves the transmission of data over a network, and against
all other unlawful forms of processing.

Clause 2

Details of the transfer
The details of the transfer and in particular the special categories of personal data where applicable are
specified in Appendix 1 which forms an integral part of the Clauses.

Clause 3

Third-party beneficiary clause

1. The data subject can enforce against the data exporter this Clause, Clause 4(b) to (i), Clause 5(a) to
(e), and (g) to (j), Clause 6(1) and (2), Clause 7, Clause 8(2), and Clauses 9 to 12 as third-party
beneficiary.

2. The data subject can enforce against the data importer this Clause, Clause 5(a) to (e) and (g), Clause
6, Clause 7, Clause 8(2), and Clauses 9 to 12, in cases where the data exporter has factually
disappeared or has ceased to exist in law unless any successor entity has assumed the entire legal
obligations of the data exporter by contract or by operation of law, as a result of which it takes on the
rights and obligations of the data exporter, in which case the data subject can enforce them against
such entity.

3. The data subject can enforce against the sub processor this Clause, Clause 5(a) to (e) and (g), Clause
6, Clause 7, Clause 8(2), and Clauses 9 to 12, in cases where both the data exporter and the data
importer have factually disappeared or ceased to exist in law or have become insolvent, unless any
successor entity has assumed the entire legal obligations of the data exporter by contract or by
operation of law as a result of which it takes on the rights and obligations of the data exporter, in which
case the data subject can enforce them against such entity. Such third-party liability of the sub
processor shall be limited to its own processing operations under the Clauses.

4. The parties do not object to a data subject being represented by an association or other body if the
data subject so expressly wishes and if permitted by national law.

Clause 4 19/26

Obligations of the data exporter

https://www.tecknowhive.com/Tecknowhive/Workflow/Agreement/PSP/PSPRegFacTemplate_V2.aspx?strMSAID=EjtFcbE9pOE=&flag=3

7/25/2018 AGREEMENT

The data exporter agrees and warrants:

(a) that the processing, including the transfer itself, of the personal data has been and will continue to be
carried out in accordance with the relevant provisions of the applicable data protection law (and, where
applicable, has been notified to the relevant authorities of the Member State where the data exporter is
established) and does not violate the relevant provisions of that State;

(b) that it has instructed and throughout the duration of the personal data processing services will instruct
the data importer to process the personal data transferred only on the data exporter's behalf and in
accordance with the applicable data protection law and the Clauses;

(c) that the data importer will provide sufficient guarantees in respect of the technical and organisational
security measures specified in Appendix 2 to this contract;

(d) that after assessment of the requirements of the applicable data protection law, the security measures
are appropriate to protect personal data against accidental or unlawful destruction or accidental loss,
alteration, unauthorised disclosure or access, in particular where the processing involves the
transmission of data over a network, and against all other unlawful forms of processing, and that these
measures ensure a level of security appropriate to the risks presented by the processing and the nature
of the data to be protected having regard to the state of the art and the cost of their implementation;

(e) that it will ensure compliance with the security measures;

(f) that, if the transfer involves special categories of data, the data subject has been informed or will be
informed before, or as soon as possible after, the transfer that its data could be transmitted to a third
country not providing adequate protection within the meaning of Directive 95/46/EC; [If these Clauses
are not governed by the law of a Member State, the words "within the meaning of Directive 95/46/EC"
are deleted.]

(g) to forward any notification received from the data importer or any sub processor pursuant to Clause
5(b) and Clause 8(3) to the data protection supervisory authority if the data exporter decides to
continue the transfer or to lift the suspension;

(h) to make available to the data subjects upon request a copy of the Clauses, with the exception of
Appendix 2, and a summary description of the security measures, as well as a copy of any contract for
sub processing services which has to be made in accordance with the Clauses, unless the Clauses or the
contract contain commercial information, in which case it may remove such commercial information;

(i) that, in the event of sub processing, the processing activity is carried out in accordance with Clause 11
by a sub processor providing at least the same level of protection for the personal data and the rights
of data subject as the data importer under the Clauses; and

(j) that it will ensure compliance with Clause 4(a) to (i).

Clause 5

Obligations of the data importer

The data importer agrees and warrants:

(a) to process the personal data only on behalf of the data exporter and in compliance with its instructions
and the Clauses; if it cannot provide such compliance for whatever reasons, it agrees to inform
promptly the data exporter of its inability to comply, in which case the data exporter is entitled to
suspend the transfer of data and/or terminate the contract;

(b) that it has no reason to believe that the legislation applicable to it prevents it from fulfilling the
instructions received from the data exporter and its obligations under the contract and that in the event
of a change in this legislation which is likely to have a substantial adverse effect on the warranties and
obligations provided by the Clauses, it will promptly notify the change to the data exporter as soon as it
is aware, in which case the data exporter is entitled to suspend the transfer of data and/or terminate
the contract;

(c) that it has implemented the technical and organisational security measures specified in Appendix 2
before processing the personal data transferred;

https://www.tecknowhive.com/Tecknowhive/Workflow/Agreement/PSP/PSPRegFacTemplate_V2.aspx?strMSAID=EjtFcbE9pOE=&flag=3 20/26

7/25/2018 AGREEMENT

(d) that it will promptly notify the data exporter about:

(i) any legally binding request for disclosure of the personal data by a law enforcement authority
unless otherwise prohibited, such as a prohibition under criminal law to preserve the
confidentiality of a law enforcement investigation,

(ii) any accidental or unauthorised access, and

(iii) any request received directly from the data subjects without responding to that request, unless
it has been otherwise authorised to do so;

(e) to deal promptly and properly with all inquiries from the data exporter relating to its processing of the
personal data subject to the transfer and to abide by the advice of the supervisory authority with regard
to the processing of the data transferred;

(f) at the request of the data exporter to submit its data processing facilities for audit of the processing
activities covered by the Clauses which shall be carried out by the data exporter or an inspection body
composed of independent members and in possession of the required professional qualifications bound
by a duty of confidentiality, selected by the data exporter, where applicable, in agreement with the
supervisory authority;

(g) to make available to the data subject upon request a copy of the Clauses, or any existing contract for
sub processing, unless the Clauses or contract contain commercial information, in which case it may
remove such commercial information, with the exception of Appendix 2 which shall be replaced by a
summary description of the security measures in those cases where the data subject is unable to obtain
a copy from the data exporter;

(h) that, in the event of sub processing, it has previously informed the data exporter and obtained its prior
written consent;

(i) that the processing services by the sub processor will be carried out in accordance with Clause 11;

(j) to send promptly a copy of any sub processor agreement it concludes under the Clauses to the data
exporter.

Clause 6

Liability

1. The parties agree that any data subject, who has suffered damage as a result of any breach of the
obligations referred to in Clause 3 or in Clause 11 by any party or sub processor is entitled to receive
compensation from the data exporter for the damage suffered.

2. If a data subject is not able to bring a claim for compensation in accordance with paragraph 1 against
the data exporter, arising out of a breach by the data importer or his sub processor of any of their
obligations referred to in Clause 3 or in Clause 11, because the data exporter has factually disappeared
or ceased to exist in law or has become insolvent, the data importer agrees that the data subject may
issue a claim against the data importer as if it were the data exporter, unless any successor entity has
assumed the entire legal obligations of the data exporter by contract of by operation of law, in which
case the data subject can enforce its rights against such entity. The data importer may not rely on a
breach by a sub processor of its obligations in order to avoid its own liabilities.

3. If a data subject is not able to bring a claim against the data exporter or the data importer referred to
in paragraphs 1 and 2, arising out of a breach by the sub processor of any of their obligations referred
to in Clause 3 or in Clause 11 because both the data exporter and the data importer have factually
disappeared or ceased to exist in law or have become insolvent, the sub processor agrees that the data
subject may issue a claim against the data sub processor with regard to its own processing operations
under the Clauses as if it were the data exporter or the data importer, unless any successor entity has
assumed the entire legal obligations of the data exporter or data importer by contract or by operation
of law, in which case the data subject can enforce its rights against such entity. The liability of the sub
processor shall be limited to its own processing operations under the Clauses.

Clause 7 21/26

Mediation and jurisdiction

https://www.tecknowhive.com/Tecknowhive/Workflow/Agreement/PSP/PSPRegFacTemplate_V2.aspx?strMSAID=EjtFcbE9pOE=&flag=3

7/25/2018 AGREEMENT

1. The data importer agrees that if the data subject invokes against it third-party beneficiary rights and/or
claims compensation for damages under the Clauses, the data importer will accept the decision of the
data subject:

(a) to refer the dispute to mediation, by an independent person or, where applicable, by the
supervisory authority;

(b) to refer the dispute to the courts in the Member State in which the data exporter is
established.

2. The parties agree that the choice made by the data subject will not prejudice its substantive or
procedural rights to seek remedies in accordance with other provisions of national or international law.

Clause 8

Cooperation with supervisory authorities

1. The data exporter agrees to deposit a copy of this contract with the supervisory authority if it so
requests or if such deposit is required under the applicable data protection law.

2. The parties agree that the supervisory authority has the right to conduct an audit of the data importer,
and of any sub processor, which has the same scope and is subject to the same conditions as would
apply to an audit of the data exporter under the applicable data protection law.

3. The data importer shall promptly inform the data exporter about the existence of legislation applicable
to it or any sub processor preventing the conduct of an audit of the data importer, or any sub
processor, pursuant to paragraph 2. In such a case the data exporter shall be entitled to take the
measures foreseen in Clause 5 (b).

Clause 9

Governing Law

The Clauses shall be governed by the law of the Member State in which the data exporter is established.

Clause 10

Variation of the contract

The parties undertake not to vary or modify the Clauses. This does not preclude the parties from adding
clauses on business related issues where required as long as they do not contradict the Clause.

Clause 11

Sub processing

1. The data importer shall not subcontract any of its processing operations performed on behalf of the
data exporter under the Clauses without the prior written consent of the data exporter. Where the data
importer subcontracts its obligations under the Clauses, with the consent of the data exporter, it shall
do so only by way of a written agreement with the sub processor which imposes the same obligations
on the sub processor as are imposed on the data importer under the Clauses. Where the sub processor
fails to fulfil its data protection obligations under such written agreement the data importer shall remain
fully liable to the data exporter for the performance of the sub processor's obligations under such
agreement.

2. The prior written contract between the data importer and the sub processor shall also provide for a 22/26
third-party beneficiary clause as laid down in Clause 3 for cases where the data subject is not able to

https://www.tecknowhive.com/Tecknowhive/Workflow/Agreement/PSP/PSPRegFacTemplate_V2.aspx?strMSAID=EjtFcbE9pOE=&flag=3

7/25/2018 AGREEMENT

3. bring the claim for compensation referred to in paragraph 1 of Clause 6 against the data exporter or the
4. data importer because they have factually disappeared or have ceased to exist in law or have become
insolvent and no successor entity has assumed the entire legal obligations of the data exporter or data
importer by contract or by operation of law. Such third-party liability of the sub processor shall be
limited to its own processing operations under the Clauses.

The provisions relating to data protection aspects for sub processing of the contract referred to in
paragraph 1 shall be governed by the law of the Member State in which the data exporter is
established.

The data exporter shall keep a list of sub processing agreements concluded under the Clauses and
notified by the data importer pursuant to Clause 5 (j), which shall be updated at least once a year. The
list shall be available to the data exporter's data protection supervisory authority.

Clause 12

Obligation after the termination of personal data processing services

1. The parties agree that on the termination of the provision of data processing services, the data
importer and the sub processor shall, at the choice of the data exporter, return all the personal data
transferred and the copies thereof to the data exporter or shall destroy all the personal data and certify
to the data exporter that it has done so, unless legislation imposed upon the data importer prevents it
from returning or destroying all or part of the personal data transferred. In that case, the data importer
warrants that it will guarantee the confidentiality of the personal data transferred and will not actively
process the personal data transferred anymore.

2. The data importer and the sub processor warrant that upon request of the data exporter and/or of the
supervisory authority, it will submit its data processing facilities for an audit of the measures referred to
in paragraph 1.

On behalf of the data exporter: NIIT LTD
[Populated with details of, and deemed signed on behalf of, the data exporter:]

Name (written out in full):

Position:

Address:

Other information necessary in order for the contract to be binding (if any):
Signature……………………………………….

On behalf of the data importer: VENDOR
[Populated with details of, and deemed signed on behalf of, the data importer:]
Name (written out in full):
Position:
Address:
Other information necessary in order for the contract to be binding (if any):

Signature……………………………………….

APPENDIX 1 TO THE STANDARD CONTRACTUAL CLAUSES

This Appendix forms part of the Clauses and must be completed and signed by the parties

The Member States may complete or specify, according to their national procedures, any additional necessary
information to be contained in this Appendix

https://www.tecknowhive.com/Tecknowhive/Workflow/Agreement/PSP/PSPRegFacTemplate_V2.aspx?strMSAID=EjtFcbE9pOE=&flag=3 23/26

7/25/2018 AGREEMENT

Data exporter
The data exporter is:
[NIIT LTD]

Data importer
The data importer is:
[VENDOR NAME]

Data subjects
The personal data transferred concern the following categories of data subjects:
[NIIT LTD Data to be transferred as applicable for the scope of delivery defined which have/will be as per SOW
or existing agreement]

Categories of data
The personal data transferred concern the following categories of data:
All personal identifiable/personal data and related data which is required for the scope of delivery

Special categories of data (if appropriate)
The personal data transferred concern the following special categories of data:
[Not Applicable]

Processing operations
The personal data transferred will be subject to the following basic processing activities:

If the scope of delivery required to transfer the personal data within the entities or out the entities determining
the necessity for the scope of delivery.

APPENDIX 2 TO THE STANDARD CONTRACTUAL CLAUSES

This Appendix forms part of the Clauses and must be completed and signed by the parties.

Description of the technical and organisational security measures implemented by the data
importer in accordance with Clauses 4(d) and 5(c):

A.Information Security

Top management shall set direction for and show commitment to information security. At a
minimum there shall be a high-level information security policy and supporting program that
applies enterprise-wide.

Information shall not be excessively stored, printed, copied, disclosed or Processed by other
means outside the purpose for use.

Information shall be processed and stored logically separated from the Suppliers own information
and from that of other customers.

Upon conclusion or termination of Supplier’s work for NIIT, the Supplier shall sanitize and
securely destroy (or at NIIT’s election return to NIIT) all copies of all Information, including all
backup and archival copies, in any electronic or non-electronic form.

Access to Information shall be restricted to Personnel individually and on a need to know basis.
Access to information needs to be on individual basis and at least password protected, and
computer screens need to be locked in case of absence.

Storage media containing Personal or Information shall be encrypted during transport and
destroyed in a secure way.

Records shall be kept in an auditable manner showing which Information has been has been
accessed, modified, disclosed or disposed.

Cryptographic controls shall be used in compliance with all relevant agreements, legislation and
regulations.

Physical access to Supplier buildings shall be restricted to Personnel individually and on a need to
have basis.

https://www.tecknowhive.com/Tecknowhive/Workflow/Agreement/PSP/PSPRegFacTemplate_V2.aspx?strMSAID=EjtFcbE9pOE=&flag=3 24/26

7/25/2018 AGREEMENT

Systems containing Information shall be protected by firewall(s) and properly hardened, i.e.
removing or disabling software and functionalities that are not being used.

Supplier networks used to access Information or networks shall have security controls that can
protect against unauthorized traffic interception or interference by making use of firewalls,
intrusion detection/prevention, etc.

Wireless network connections transferring Information shall be encrypted according to best
practice.

Supplier shall deploy technology to scan Supplier’s corporate email for viruses and malicious
code and links and keep such technology up to date.

Disclosing Information to a third party, such as a Third Party Sub-Processor, shall only be
allowed with prior written consent from and only for the purposes identified in contractual
agreements with NIIT.

Third Party Sub-Processors shall be restricted to only the necessary access, use, retention and
disclosure of Information needed to fulfill contractual obligations.

Third Party Sub-Processors shall be given clear instructions on security measures for protecting
Information.

Supplier shall have a documented security incident management process to detect and handle
incidents. Supplier shall report confirmed security incidents or weaknesses involving Information
or Services for as soon as practicable or as otherwise agreed upon. Security related incidents
should be reported to: [email protected], appointed point of contact or as
otherwise specified in contractual agreements.

Supplier shall cooperate fully with in dealing with these reports. Cooperation may include
providing access to computer-based evidence data for forensic evaluation.

B. Data Privacy

a. Top management shall set direction for and show commitment to privacy. At a minimum there shall be
a high-level privacy policy that applies enterprise-wide and assignment of overall responsibility for
privacy to a top-level executive or equivalent.

b. Supplier shall ensure protection and privacy of Personal Information related to Services in accordance
with relevant data protection legislation and regulations.

c. Personal Information, including redacted or Anonymized Personal Data, shall not be used for any other
purpose than meeting contractual agreements with NIIT.

d. Personal Information collected for different purposes shall be processed separately.

e. Personal Information shall not be accessed without prior authorization.

f. Authorized Personnel shall only have access to the least amount of Personal Information to carry out
their job duty.

g. Personnel with access to Personal Information shall be required to take appropriate data privacy
training on a regular basis.

h. Personal Information shall be retained for only as long as necessary to fulfill the stated purposes in
contractual agreements with NIIT, or as required by law or regulations, and shall thereafter be
appropriately returned or disposed at the choice of NIIT.

i. The disposal of Personal Information shall be recorded to certify to that such disposal has taken place.

j. Where the return or disposal of some, or all of the Personal Information is prevented by law or
regulation, the Personal Information shall be kept confidential or anonymized and shall no longer be
processed. shall be informed if such obligations exist immediately when supplier becomes aware of
them.

k. Personal Information shall not be excessively stored, printed, copied, disclosed or other means of
Processing outside the purpose for use.

l. The Data Subject shall be provided with access to his or her Personal Information for review.

https://www.tecknowhive.com/Tecknowhive/Workflow/Agreement/PSP/PSPRegFacTemplate_V2.aspx?strMSAID=EjtFcbE9pOE=&flag=3 25/26

7/25/2018 AGREEMENT

m. In the event the Data Subject does not have direct access to his or her Personal Information, the
Personal Information shall be transferred to in order to support any Data Subject request, without
answering the request unless authorized to do so.

n. Inaccurate Personal Information shall be corrected when the Data Subject or on the Data Subject’s
behalf, has made a request for correction.

o. As long as the correctness of data is disputed the data shall be blocked for processing.

p. Disclosing Personal Information to a third party, such as a Third Party Sub-Processor, shall only be
allowed with prior written consent from and only for the purposes identified in contractual agreements
with NIIT. shall have the right to evaluate the contractual terms and conditions described in section 3.q.

q. Prior to Supplier transferring Personal Information to a Third Party Sub-Processor, the Supplier shall
ensure responsibilities of Supplier and of the Third Party Sub-Processor are clearly described and
implemented as part of the commercial contract. The terms and conditions set out below shall be
analyzed on a case by case basis:

i. The clear agreement that is either the Data Controller or Data Processor and the Supplier and
Third Party Sub-Processor are the data Sub-Processors

ii. The clear agreement that Supplier has the right to audit the Third Party Sub-Processor with
respect to data privacy.

iii. The clear definition of what constitutes Personal Information.

iv. The clear definition of applicable law(s) for processing Personal Information and for
transferring such information cross border.

v. Clear instructions on when and where the Third Party Sub-Processor is expected to report a
Privacy Breach.

vi. Clear instructions on security measures for protecting privacy including the appropriate
technical and organizational measures to safeguard the Personal Information to the same or
higher level of protection as provided by NIIT.

Compliance

a. Supplier internal audits and/or assessments concerning security and privacy shall be
performed regularly by trained Personnel and findings shall be evaluated for possible
corrective actions.

b. Upon 15 days’ request from NIIT, Supplier shall be able to demonstrate compliance with these
Privacy Requirements and any other security and privacy requirements or measures that have
been agreed with NIIT. Identified non-compliance shall be dealt with as agreed by the parties.

https://www.tecknowhive.com/Tecknowhive/Workflow/Agreement/PSP/PSPRegFacTemplate_V2.aspx?strMSAID=EjtFcbE9pOE=&flag=3 26/26