Vercel Terms of Service DORA Addendum

1. Introduction

1.1 To the extent that you are a company or other legal entity subject to DORA, this DORA Addendum ("Addendum") is entered into and is supplemental to, and made pursuant to, the Terms of Service or other agreement between you and Vercel Inc. ("Vercel") governing the provision of Vercel's cloud-based platform or software services to you ("Agreement"); is effective as of the later of: January 17, 2025 or the effective date of your Agreement ("Addendum Effective Date"); and the provisions below, including the additional definitions set out in paragraph 3, shall apply in relation to the provision of the Services by Vercel under the Agreement.

1.2 Except as set forth below, all other terms and conditions of the Agreement are hereby incorporated by reference and shall remain in full force and effect.

1.3 You enter into this Addendum on behalf of yourself to the extent required under DORA. If you are entering into this Addendum on behalf of a company or other legal entity, you represent and warrant that you have the legal authority to bind the entity to this Addendum, in which case "you" (whether or not capitalized) means the entity you represent and any Affiliates to the extent such Affiliates are included and covered under the Agreement. If you do not have such authority or are not subject to DORA, this Addendum shall be void.

1.4 In the event of any conflict between the provisions set out in this Addendum and the rest of this Agreement, the provisions in this Addendum shall govern solely to the extent of the conflict.

2. Vercel Commitments

2.1 The Services provided by Vercel to you are described in the Agreement.

2.2 Vercel shall:

1. ensure or procure that the Service is only provided from, and Your Content is only stored and processed in, the United States or countries where Vercel or its subprocessors maintain operations (each, a "Service Location"); and

2. notify you in advance if any of the Service Locations will change.

2.3 Vercel shall:

1. ensure that you have access to all Your Content in Vercel's possession or control, in an easily accessible format through the Services, in the event:

   1. Vercel is subject to an Insolvency Event;

   2. Vercel's business operations are subject to resolution or discontinuation; or

   3. of termination or expiry of this Agreement within thirty (30) days of such event and upon request; and

2. ensure that it has and maintains in place and procure that its relevant subcontractors have and maintain in place, appropriate security standards and procedures designed to protect the availability, authenticity, integrity and confidentiality of Your Content.

2.4 Vercel shall perform the Service in accordance with the service standards set out in the Agreement or, if there are no service standards specified, in accordance with standard industry practice and applicable law.

2.5 In the event an ICT-Related Incident occurs in relation to the Service, Vercel shall, except where Vercel is responsible for the ICT-Related Incident, in return for the payment of fees calculated on a time and materials basis, using Vercel's rates then in effect, provide or procure the provision of such reasonable assistance as you may request in relation to the investigation, management and resolution of the ICT-Related Incident.

2.6 Vercel shall, at all times during the term of the Agreement, cooperate with your Regulators and their appointees in fulfilling their respective oversight and resolution functions.

2.7 In addition to any other termination rights in this Agreement, you may terminate this Agreement on the provision of thirty (30) days' notice to Vercel if:

1. Vercel commits a material breach of applicable law or this Addendum, and such breach is irremediable or (if such breach is remediable) fails to remedy that breach within 30 days after being notified in writing by you to do so;

2. Vercel's contract with any material subcontractor terminates or expires without a reasonably similar replacement, with the result that Vercel is unable to perform the Service in accordance with this Agreement;

3. Vercel's breach of this Agreement has resulted in three (3) or more ICT-Related Incidents in any one (1) month period; or

4. you have received a binding order or other direction from a Regulator, compliance with which requires you to terminate this Agreement.

2.8 Vercel shall perform or procure the performance of regular security testing of its ICT systems used in the performance of the Service and shall promptly mitigate or remediate any material issues identified by such tests.

2.9 To the extent such information is not made available through Vercel's Trust Center (available at https://security.vercel.com), Vercel shall provide, upon reasonable request, any information reasonably requested by you from time to time in relation to Vercel's compliance with this Addendum.

3. Definitions

3.1 The additional definitions set out in this paragraph 3 shall apply:

1. "Affiliate" means any entity that directly or indirectly controls, is controlled by, or is under common control with the subject entity. "Control" for purposes of this definition, means direct or indirect ownership or control of more than 50% of the voting interest of the subject entity.

2. "DORA" means Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU) No 909/2014 and (EU) 2016/1011, and any relevant law, statute, declaration, decree, directive, legislative enactment, order, ordinance, regulation, rule or other binding instrument which implements the above;

3. "ICT-Related Incident" means a single event or a series of linked events that is unplanned, results in the confirmed compromise of the security of your network and information systems and leads to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of either: (i) Your Content; or (ii) the provision of services by you to your own clients;

4. "Insolvency Event," in relation to a party to the Agreement, means that such party is subject to a bankruptcy or insolvency proceeding under applicable law, or is otherwise insolvent or unable to pay its debts within the meaning of bankruptcy or insolvency legislation applicable to the party concerned;

5. "Regulator" means any supervisory or government agency, body or authority having regulatory or supervisory authority over your business operations, including any relevant competent authority under DORA; and

6. "Service Location" has the meaning given to it in paragraph 2.1(a) of this Addendum.

3.2 Capitalized terms used but not defined herein shall have the meaning given in the Agreement.