Processor agreement

This Processor Agreement ("Processor Agreement") is a legal agreement that is an inseparable part of and applicable in addition to the existing Flora Logistics Services Agreement ("Services Agreement"), entered into by and between Customer as the data controller and Flora Logistics which is Customer's contracting party as processors in connection with the provision of services, including various data processing services.

By signing the Services Agreement, you accept the Processor Agreement, which is incorporated herein by reference.

This Processor Agreement consists of:

1. a.the main text of the Processor Agreement;
2. b.Appendix 1 - Description of Flora Logistics' Security Measures;

The terms used in this Processor Agreement have the same meaning as the terms used in the Services Agreement, unless expressly stated otherwise. If there are any contradictions or inconsistencies between the Services Agreement and this Processor Agreement, this Processor Agreement shall prevail.

In performing the Services, Flora Logistics may access or otherwise receive or process information relating to identified or identifiable individuals ("Personal Data").

Depending on how the Customer chooses to use the Services, Flora Logistics may process the following types of Personal Data:

1. a.First and last name;
2. b.Contact information (e-mail address, home address, phone number);
3. c.Language;
4. d.Date of birth;
5. e.IP address;
6. f.Geolocation data (excluding nationality);
7. g.Government-issued identification numbers (e.g., social security number);
8. h.Financial Information;
9. i.Bank account information;

Flora Logistics may also process other types of Personal Data if the Customer has elected to collect and enter such Personal Data into our Services. The Services do not require other types of Personal Data to function properly. Flora Logistics disclaims any liability for damages or claims related to Customer's choice to enter non-mandatory Personal Data into the Services.

Personal Data about the following categories of individuals is processed:

Owners of businesses that sign up for Flora Logistics Services.

Employees and other persons authorized by Customer to access and use the Services ("End Users").

Individuals whose Personal Data is processed using the Services, including customers and suppliers of the Customer.

Flora Logistics is a provider of a software platform for buyers and sellers of floricultural products engaged in e-commerce and related activities.

Flora Logistics processes Personal Data on behalf of Customer to provide those services to Customer pursuant to the Services Agreement and any additional purposes on Customer's behalf when using the Services.

When Flora Logistics acts as a processor of Personal Data, Flora Logistics may only process Personal Data process on behalf of Customer and only for the purposes set forth in this Processor Agreement and the Services Agreement.

a. Customer is the ("Controller") of all Personal Data it collects through the Services. Customer assures that it is entitled to process and transmit the Personal Data to Flora Logistics so that Flora Logistics may lawfully process the Personal Data on behalf of Customer, as contemplated by this Processor Agreement.

1. b.Flora Logistics acts as a ("processor") of the data collected by Customer through the use of the Services. Personal data.
2. c.Customer hereby acknowledges Flora Logistics' written consent:
3. a.That affiliates of Flora Logistics may act as ("sub-processors") of Flora Logistics; and
4. b.That Flora Logistics may engage sub-processors as necessary to perform the Services. The list of Flora Logistics's permitted sub-processors is located on Flora Logistics' website (www.floralogistics.nl), and Customer acknowledges that these sub-processors are essential to providing the Services. Flora Logistics will notify Customer if it adds, replaces or changes any sub-processors by updating the aforementioned list. Customer may object to the changes within 30 calendar days of the change on justifiable grounds and in accordance with the principles of good faith, reasonableness and fairness. Customer acknowledges that if Customer objects to Flora Logistics' use of a sub- processor, Flora Logistics will not be obligated to provide to Customer the Services for which Flora Logistics uses that sub-processor.

Flora Logistics ensures that all processing is done fairly, lawfully and in accordance with the obligations of this Processor Agreement as well as applicable AVG legislation. In particular:

Instructions from the controller

Flora Logistics processes Personal Data only on the basis of Customer's documented instructions; if Flora Logistics is required to additionally process Personal Data in accordance with an applicable law or applicable regulation, Flora Logistics will notify Customer of such legal obligation prior to such processing, unless an applicable law or applicable regulation prohibits it from doing so;

Ensuring appropriate protection

Flora Logistics shall ensure appropriate protection of Personal Data against accidental or unlawful destruction or accidental loss, alteration, unauthorized disclosure or access, especially if the processing involves the transmission of Personal Data over a network, and against all other unlawful forms of processing;

Security safeguards

Flora Logistics complies with the security standard shown in Appendix 1, taking into account the state of the art, implementation costs and the nature, scope, context and purposes of processing;

Information sharing

Flora Logistics shall not share any Personal Data with any third party or unauthorized persons unless the Customer has given its prior written consent to such disclosure and subject to the terms and conditions set forth in Article 6 of this Processor Agreement;

Confidentiality

Flora Logistics maintains Personal Data in strict confidentiality and requires its employees and all other persons under its control who will access or otherwise process Personal Data to adhere to the same level of confidentiality in accordance with the requirements of this Processor Agreement (including during the term of their employment or hiring and thereafter);

Requests from stakeholders

Flora Logistics shall take appropriate measures to support Customer in fulfilling its obligations as a data controller in responding to requests from individual data subjects to exercise their rights under applicable data protection law. In addition, Flora Logistics will promptly inform Customer if it receives a request from an individual regarding Personal Data, including but not limited to requests for access to the information, requests for rectification of the information, requests to block, erase or transfer Personal Data, and will not respond to such requests unless it is expressly authorized to do so by Customer or unless it is required to do so under an applicable data protection law or a law of the European Union or a Member State applicable to Flora Logistics. In addition, Flora Logistics shall ensure that it implements technical and organizational measures to support Customer's compliance with its obligation to respond to such requests from an individual regarding processed Personal Data. Flora Logistics shall handle in a timely and proper manner requests for information and queries from Customer in connection with the processing of Personal Data under this Processor Agreement and provide other reasonable assistance and support;

Customer compliance support

Flora Logistics shall support the Customer in ensuring compliance with obligations regarding security measures and conducting data protection impact assessments, if necessary pursuant to Articles 32-36 of the General Data Protection Regulation (GDPR). Flora Logistics shall assist and support Customer in the event of an investigation by a data protection authority or similar authority, insofar as such investigation relates to the processing of Personal Data under this Processor Agreement. Flora Logistics shall promptly notify Customer if, in Flora Logistics' opinion, any instruction given by Customer, or any applicable law or regulation, including data protection laws, or any change in applicable law or regulation is likely to have a material adverse effect on Flora Logistics' ability to comply with its obligations under this Processor Agreement; Flora Logistics shall be entitled to suspend the performance of the relevant instruction until confirmed or modified by Customer. Flora Logistics may refuse to carry out an instruction that is clearly unlawful;

Requests for disclosure

To the extent permitted by applicable law, Flora Logistics shall notify Customer of any request received by Flora Logistics from a governmental authority to disclose Personal Data processed as part of the Services Agreement or to participate in an investigation involving such Personal Data. Flora Logistics will make reasonable efforts to narrow the scope of any such request received and will provide only the Personal Data specifically requested;

Data breach

Flora Logistics shall promptly (and in any event within forty-eight (48) hours) after it becomes aware thereof, inform Customer of any facts known to Flora Logistics concerning any actual, inadvertent or unauthorized access, disclosure or use, or inadvertent or unauthorized loss, damage or destruction of Personal Data by any current or former employee, contractor or agent of Flora Logistics or by any other person or third party; Flora Logistics will fully cooperate with Customer in the event of an inadvertent or unauthorized access, disclosure or use, or inadvertent or unauthorized loss, damage or destruction of Personal Data by a current or former employee contractor or agent of Flora Logistics or by any other person or third party, in order to mitigate the unauthorized disclosure or use, recover the Personal Data, and assist Customer in reporting to the appropriate regulators and affected persons if requested by Customer;

Flora Logistics may outsource the performance of any part of the Services to third parties as sub-processors (including affiliates of Flora Logistics outside the EEA, Switzerland and the UK) only if Flora Logistics ensures that such sub-processors are bound in writing to the same obligations and Customer is granted the same rights as contained in this Processors Agreement with respect to such sub-processors.

Flora Logistics processes Personal Data for as long as reasonably necessary to provide the Services. The retention period may be longer if Flora Logistics is required by applicable law or to manage its business to retain Personal Data for a longer period.

Upon Customer's request, Flora Logistics shall immediately cease processing Personal Data and shall promptly return or delete all such Personal Data, in accordance with such instructions as may be given by Customer at that time, unless Flora Logistics is obligated to store the Personal Data pursuant to applicable law or regulations applicable to it or unless otherwise expressly agreed with Customer. The obligations set forth in this Article shall remain in effect notwithstanding termination or expiration of this Processor Agreement.

Flora Logistics shall make available to Customer any information necessary to demonstrate compliance with its obligations regarding the processing of Personal Data provided to Flora Logistics in its role as data processor.

Flora Logistics shall make the processing systems, facilities and supporting documentation relating to the processing of Personal Data available for an audit by Customer or a qualified independent reviewer selected by Customer, and it shall provide all support that Customer may reasonably require for the audit, but no more than once in any 1 2 - month period. If the audit shows that Flora Logistics has breached any obligation under the Processor Agreement, Flora Logistics shall promptly remedy such breach;

In the event of an inspection or audit by a competent governmental authority with respect to the processing of Personal Data, Flora Logistics will make its relevant processing systems, facilities and supporting documentation available to the relevant competent governmental authority for an inspection or audit if necessary to comply with applicable laws. In the event of an inspection or audit, each party will provide all reasonable assistance to the other party in responding to that inspection or audit. If any competent governmental authority determines that the processing of Personal Data under this Processor Agreement is unlawful, the parties will take immediate action to ensure future compliance with applicable data protection laws. Instead of on-site inspections and checks, Flora Logistics may refer the Customer to equivalent verification by independent third parties (such as neutral data protection auditors), compliance with approved rules of conduct (Art. 40 AVG) or appropriate data protection or ICT security certifications pursuant to Art. 42 AVG. This applies in particular if Flora Logistics' trade secrets or Personal Data of third parties would be compromised by the checks;

Unless Flora Logistics is prohibited by law from making such a disclosure, Flora Logistics shall promptly notify Customer if:

1. a.it receives a demand for information, a subpoena or a request for inspection or audit from a competent governmental authority with respect to the processing of Personal Data to which this Processor Agreement applies, insofar as it involves the Customer's data; or
2. b.it intends to disclose Personal Data to a competent governmental authority.

Flora Logistics shall ensure that any employee, agent, independent contractor or any other person involved i n the provision of the Services who has access to Customer Personal Data complies with all data protection and privacy laws and regulations (including any legislative and/or regulatory changes or successors thereto) applicable to Flora Logistics.

Customer authorizes Flora Logistics to order processing in a third country, including by sub-processors, if the specific requirements of Article 44-49 AVG are met. Customer is deemed to have given explicit consent to processing in a third country with respect to the processing activities performed by Flora Logistics and its sub-processors, as listed here: www.floralogistics.nl/privacy/processors.

Customer may contact Flora Logistics at any time at info@floralogistics.nl with all its questions and suggestions regarding data protection.

No lien

The parties agree that the Customer has no lien on the data to be processed and related storage media.

Changes

Any amendments or additions to this Processor Agreement must be in writing. The same applies to any waiver of a right or obligation under this Processor Agreement. The ranking of individual contractual agreements shall not be affected thereby. Flora Logistics reserves the right t o amend this Processor Agreement at any time with effect for the future. Amendments will only be made if there are the following objective reasons:

1. a.if the change helps to bring the Processor Agreement into conformity with applicable law, in particular if the applicable legal situation changes;
2. b.If the change enables Flora Logistics to comply with mandatory court or administrative decisions;
3. c.if the change reflects details of a new or updated Flora Logistics Service or new or updated technical or organizational processes and does not affect the existing contractual relationship with the Customer to the detriment of the Customer;
4. d.If the change is purely for the benefit of the Customer.

Severability

If any provision of this Agreement is or becomes invalid or practically unenforceable, in whole or in part, it shall not affect the validity of the remaining provisions.

Duration

This Processor Agreement takes effect on the Effective Date and ends on the date the Services Agreement expires or is terminated.

Appendix 1 Security measures of Flora Logistics Flora Logistics has taken appropriate and sufficient technical and organizational measures to secure the Personal Data to prevent a breach that accidentally or unlawfully results in the loss, destruction, modification or unauthorized disclosure of or access to Personal Data, in particular where the processing involves a transmission of Personal Data over a network, as well as against all other unlawful forms of data processing.

Flora Logistics has an established information security organization managed by the Flora Logistics security team and led by the Chief Technology Officer. Flora Logistics has established, and maintains, policies and procedures to implement standards for logical access to Flora Logistics' production environments. The policies also identify functional responsibilities for managing logical access and security. Information security-related policies are reviewed and approved annually by security management and are used to help Flora Logistics meet the service promises we make to Customer.

The following description provides an overview of the technical and organizational security measures implemented. These measures include, but are not limited to those listed below. For more detailed information on the most advanced measures, please contact us directly.

Data Protection Flora Logistics processes Personal Data as a data processor solely for the purpose of providing the Services in accordance with documented instructions from the Customer (provided such instructions are commensurate with the functionalities of the Services) and as may be agreed with the Customer.

Flora Logistics implements and maintains appropriate technical and organizational measures to protect Personal Data from unauthorized or unlawful processing and from accidental loss, destruction, damage, theft, alteration or disclosure.

Flora Logistics ensures that employees who have access to Personal Data are bound by confidentiality obligations that limit their ability to disclose the Personal Data.

Flora Logistics applies the concepts of least privilege (minimum authorization) and need to know, allowing only access that users need to perform their tasks. User accounts are created with minimum access rights. Access to information requiring more than minimum authorization must obtain appropriate and separate approval. Flora Logistics applies Multi-Factor Authentication to all critical applications and infrastructure.

In transit: Flora Logistics makes HTTPS encryption available on all login interfaces and on any Customer website hosted on Flora Logistics' Products. Flora Logistics' HTTPS implementation uses standard algorithms and security certificates.

At rest: Flora Logistics stores user passwords according to industry standard security practices. Flora Logistics applies encryption at rest to other sensitive fields specifically identified by Flora Logistics.

Prevention of unauthorized access to products

Third-party processing: (IaaS). In addition, Flora Logistics maintains contractual relationships with vendors to deliver the service in accordance with our data processing agreement. Flora Logistics relies on contractual agreements, privacy policies and supplier compliance programs to protect data processed or stored by these suppliers.

Physical and environmental security: Flora Logistics hosts its product infrastructure with multi-tenant, outsourced infrastructure providers. Our infrastructure providers' physical and environmental security controls include SOC 2 Type II, ISO 27001 and PCI DSS compliance.

Authentication: Flora Logistics has implemented a uniform password policy for its products. All users who need to interact with the products through any interface must authenticate before accessing non-public customer data.

Authorization: Customer data is stored in multi-tenant storage systems that can be accessed by customers solely through user interfaces and the API. Customers do not have direct access to the underlying application infrastructure. The authorization model in each Flora Logistics product is designed to ensure that only designated individuals have access to relevant features, views and customization options. Authorization for data sets is performed by validating the user's permissions against the attributes associated with each data set.

Prevention of unauthorized use of the product

Access controls: Network access control mechanisms are designed to prevent network traffic from reaching the product infrastructure through unauthorized protocols. The technical measures implemented vary by infrastructure providers and include Virtual Private Cloud (VPC) implementations, security group assignment and traditional firewall rules.

Intrusion detection and prevention: Flora Logistics has implemented a Web Application Firewall (WAF) solution to protect certain hosted Products and other Internet-accessible applications identified by Flora Logistics. The WAF is designed to identify and prevent attacks on publicly available services.

Scanning for vulnerabilities: Flora Logistics regularly scans its code, infrastructure and web services for known vulnerabilities and fixes them in a timely manner. Flora Logistics subscribes to news releases for applicable vendor flaws and actively monitors vendor websites and other relevant channels for new patches.

Limitations of privilege and authorization requirements

Product access: Some of Flora Logistics' employees have access to products and customer data through controlled interfaces. Granting access to a group of employees is intended to provide effective support, resolve potential problems, detect and respond to security incidents, and implement data security. Employees may be granted access by virtue of their position or by submission of an approved request. Login sessions to data storage or processing systems are recorded.

Database access: Customer data is accessible only to authorized employees. Direct database access is restricted and access rights are established and adhered to.

Incident Management Control

Detection: Flora Logistics has designed its infrastructure to log comprehensive information about the system, data traffic received, system authentication and other requests. Internal systems collect data and alert authorized personnel about malicious, unintentional or abnormal activity. Flora Logistics personnel, including the security team and support, will respond to known incidents.

Response and tracking: Flora Logistics maintains a record of known security incidents with descriptions, dates and times of relevant activities and incidents. Suspected and confirmed security incidents are investigated by security, operations or support and appropriate steps are identified and documented. For all confirmed incidents, Flora Logistics takes appropriate action to minimize damage to products and customers or unauthorized disclosure.

Communication: If Flora Logistics becomes aware of unauthorized access to Customer Data stored in its products, Flora Logistics will, if and to the extent it deems necessary or is required to: notify affected Customers of the incident; share a description of the steps Flora Logistics is taking to resolve the incident; share status updates with those Customers. Notification of any incidents will be delivered to one or more Customer contacts in a form selected by Flora Logistics, possibly via email or telephone.