WeWork Workplace Add-On Data Processing Addendum

Effective Date: June 1, 2026 

This Data Processing Addendum (“DPA“) forms part of, and is subject to, the WeWork Workplace Terms (the “Terms”) between the member of the WeWork Group that is a party to those Terms (“WeWork“) and the legal entity defined as ‘Customer’ thereunder and each Customer Affiliate that is party to an Order Form pursuant to the Terms, if applicable, (collectively and individually referred to herein as “Customer”). All capitalized terms not defined in this DPA shall have the meanings set forth in the Terms.

1. DEFINITIONS

“Affiliate” means any entity that directly or indirectly controls, is controlled by, or is under common control with the subject entity. “Control,” for purposes of this definition, means direct or indirect ownership or control of more than 50% of the voting interests of the subject entity.

“Authorized Affiliate“ means any Customer Affiliate(s) that is permitted to use the Services pursuant to the Agreement between WeWork and Customer, but has not signed its own Order Form with WeWork, for so long as such entity remains a Customer Affiliate.

“business” shall have the meaning given to such term under California Data Protection Laws.

“California Data Protection Laws“ means the California Consumer Privacy Act of 2018 (CCPA) and the California Privacy Rights Act of 2020 (CPRA), as may be amended from time to time.

“consumer” shall have the meaning given to such term under California Data Protection Laws.

“controller” means an entity that determines the purposes and means of the processing of Personal Data.

“Customer Personal Data” means any Customer Data that is personal data.

“Data Protection Law” means all data protection and privacy laws applicable to the respective party in its role in the processing of personal data under the Agreement.

"EU P-to-P SCCs" means the standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and the Council approved by European Commission Implementing Decision (EU) 2021/914 of 4 June 2021, as currently set out at: https://eurlex.europa.eu/eli/dec_impl/2021/914/oj to the extent they reference “MODULE THREE: Transfer processor to processor.”

“GDPR” means Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

“personal data” means any information relating to an identified or identifiable natural person (“data subject”) and includes similarly defined terms in Data Protection Law, including, but not limited to, the definition of “personal information” under California Data Protection Laws.

“processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction. “Process”, “processes” and “processed” will be interpreted accordingly.

“processor” means an entity that processes personal data on behalf of a controller.

“Security Incident” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of or access to Customer Personal Data.

“Services” has the meaning set forth in the Agreement. Services exclude WeWork Membership Services.

“SCCs” means, as applicable, the standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and the Council approved by European Commission Implementing Decision (EU) 2021/914 of 4 June 2021, as currently set out at: https://eurlex.europa.eu/eli/dec_impl/2021/914/oj (the “EU SCCs”) and/or the International Data Transfer Addendum issued by the Information Commissioner’s Office under s.119(A) of the UK Data Protection Act 2018, currently found at: https://ico.org.uk/media/for-organisations/documents/4019539/international-data-transfer-addendum.pdf (the “UK Addendum”).

“sub-processor” means any processor engaged by WeWork or a member of the WeWork Group to process Customer Personal Data.

“UK GDPR” means the GDPR as it forms part of United Kingdom law pursuant to Section 3 of the European Union (Withdrawal) Act 2018, and as applicable, secondary legislation made under that Act and the Data Protection Act 2018.

“WeWork Group” means WeWork Inc. and its Affiliates engaged in the processing of Customer Personal Data.

“WeWork Membership Services” means the membership services provided by a member of the WeWork Group pursuant to a Membership Agreement or other written or electronic agreement for the purchase of membership services. For illustrative purposes only, WeWork Membership Services include, without limitation, and to the extent applicable, access to and use of WeWork’s offices, workstations and/or workspaces, access to and use of the WeWork member network, access to and use of the shared Internet connection, use of printers, copiers and/or scanners, use of conference rooms, use of common areas, kitchens and pantries, opportunity to participate in members-only benefits and promotions, etc.

2. SCOPE AND APPLICABILITY OF THIS DPA

This DPA applies where and only to the extent that WeWork processes Customer Personal Data on behalf of Customer as processor in connection with the provision of the Services. Any other processing of personal data with respect to Customer and Customer’s employees, agents or Authorized Users conducted by WeWork and/or members of the WeWork Group, including but not limited to, processing of personal data in connection with WeWork Membership Services, shall be carried out by WeWork and/or members of the WeWork Group as permitted under Data Protection Law and in accordance with the WeWork Group’s then-current privacy policy located at https://www.wework.com/legal/global-privacy-policy (or any successor hyperlink). To the extent a conflict exists between this DPA and the Agreement regarding the subject matter of this DPA, the terms of this DPA shall govern.

3. PROCESSING OF CUSTOMER PERSONAL DATA

3.1 Roles of the Parties.  With regard to the processing of Customer Personal Data, the parties acknowledge and agree that: (i) Customer is a controller or a processor on behalf of a third-party controller (such third-party, the “Third-Party Controller”), (ii) WeWork is a processor and (iii) WeWork and/or members of the WeWork Group will engage sub-processors pursuant to the requirements set forth in Section 4 below.

3.2 WeWork’s Processing of Customer Personal Data. Customer instructs WeWork (and authorizes WeWork to instruct each sub-processor) to process Customer Personal Data only in accordance with applicable law: (i) to provide, secure, and monitor the Services, including any cross-border transfers of Customer Personal Data in performance of the Services; (ii) as further specified via Customer’s use of the Services (including the Platform and other functionality of the Services); (iii) as initiated by Authorized Users in their use of the Services; (iv) as documented in the Agreement (including this DPA) and any applicable ordering documents, including service orders, order forms, statements of work and product or service descriptions and (v) as further documented in any other written instructions given by Customer and acknowledged by WeWork as constituting instructions for purposes of this DPA ((i)-(v) collectively, the “Customer Instructions”). WeWork shall process Customer Personal Data only in accordance with Customer Instructions, except as required to comply with a legal obligation to which WeWork is subject. WeWork shall be allowed to exercise its own discretion in the selection and use of such means as it considers necessary to provide the Services, subject to the requirements of this DPA.

3.2.1 Customer Instructions. Customer shall ensure that the Customer Instructions comply with Data Protection Law and shall ensure that WeWork’s processing of Customer Personal Data, when done in accordance with the Customer Instructions, shall not cause WeWork to violate any applicable law or regulation, including Data Protection Law. Where applicable, (i) Customer shall ensure that the Customer Instructions are consistent with all instructions from the Third-Party Controller and (ii) Customer shall be responsible for any communications, notifications, assistance and/or authorizations that may be required in connection with a Third-Party Controller.

3.2.2 Additional Instructions. Additional instructions outside the scope of the Agreement, an applicable ordering document or this DPA shall be agreed to between the parties in writing, including any additional fees that may be payable by Customer to WeWork for carrying out those instructions.

3.2.3 Duty to Inform. To the extent required by Data Protection Law, WeWork shall inform Customer if, in WeWork’s reasonable opinion, any Customer Instructions violate such Data Protection Law.

3.3 Customer Personal Data Subject to California Data Protection Laws. Without limiting WeWork’s obligations under this DPA and to the extent Customer Personal Data is subject to California Data Protection Laws, the following terms shall apply with respect to the processing of such Customer Personal Data: (i) Customer discloses such Customer Personal Data to WeWork only for the limited and specified purpose of providing the Services in accordance with Customer Instructions (the “Contracted Purposes”); (ii) WeWork shall comply with the applicable obligations under the CPRA and shall provide the same level of privacy protections to such Customer Personal Data as is required under California Data Protection Laws; (iii) Customer shall have the right to take reasonable and appropriate steps to ensure that WeWork uses such Customer Personal Data in a manner consistent with Customer’s obligations as a business under the CPRA; (iv) WeWork shall notify Customer without undue delay if it determines that it can no longer meet its obligations under the CPRA; (v) Customer shall have the right, upon notice, to take reasonable and appropriate steps to stop and remediate unauthorized use of such Customer Personal Data and (vi) WeWork shall not: (A) sell or share such Customer Personal Data; (B) retain, use or disclose such Customer Personal Data for any purpose other than for the Contracted Purposes, including retaining, using, or disclosing such Customer Personal Data for a commercial purpose other than the Business Purposes or as otherwise permitted by California Data Protection Laws; (C) retain, use or disclose such Customer Personal Data outside of the direct business relationship between WeWork and Customer or (D) combine such Customer Personal Data with personal data that it receives from or on behalf of another person or persons or collects from its own interaction with a consumer, provided that WeWork may combine personal data to perform any business purpose as defined in regulations adopted pursuant to the California Data Protection Laws.

3.4 Customer’s Processing of Customer Personal Data. Customer shall be solely responsible for ensuring: (i) that it has complied, and shall continue to comply, with Data Protection Law in its use of the Services, including any applicable requirement to provide notice to data subjects of the use of WeWork as a processor; (ii) the accuracy, quality and legality of the Customer Personal Data, including the means by which Customer acquires the Customer Personal Data and (iii) that it has obtained all consents, permissions and rights necessary under Data Protection Law to share Customer Personal Data with WeWork and for WeWork to lawfully process Customer Personal Data according to Customer Instructions.

3.5 Customer Affiliates. WeWork’s obligations set forth in this DPA shall also extend to Authorized Affiliates, subject to the following conditions:

3.5.1 Contractual Relationship. The parties acknowledge and agree that, by executing the Agreement, Customer enters into this DPA on behalf of itself and, as applicable, in the name and on behalf of its Authorized Affiliates, thereby establishing a separate DPA between WeWork and each such Authorized Affiliate subject to the provisions of the Agreement and this Section 3.5 and Section 10. Each Authorized Affiliate agrees to be bound by the obligations under this DPA and, to the extent applicable, the Agreement. For the avoidance of doubt, an Authorized Affiliate is not and does not become a party to the Agreement, and is a party only to this DPA. All access to and use of the Services by Authorized Affiliates must comply with the terms and conditions of the Agreement and any violation of the terms and conditions of the Agreement by an Authorized Affiliate shall be deemed a violation by Customer. For the purposes of this DPA only, and except where indicated otherwise, the term “Customer” shall include Customer and Authorized Affiliates, as applicable.

3.5.2 Communication. Customer (that is the contracting party to the Agreement) shall remain responsible for coordinating all communication with WeWork under this DPA and be entitled to make and receive any communication in relation to this DPA on behalf of its Authorized Affiliates. Customer must exclusively communicate any additional processing instructions requested pursuant to 3.2 directly to WeWork, including instructions from its Authorized Affiliates.

3.5.3 Rights of Authorized Affiliates. Where an Authorized Affiliate becomes a party to this DPA with WeWork, it shall to the extent required under Data Protection Law be entitled to exercise the rights and seek remedies under this DPA, subject to the following:

3.5.3.1 Except where Data Protection Law requires the Authorized Affiliate to exercise a right or seek any remedy under this DPA against WeWork directly by itself, the parties agree that (i) solely Customer (that is the contracting party to the Agreement) shall exercise any such right or seek any such remedy on behalf of the Authorized Affiliate and (ii) Customer (that is the contracting party to the Agreement) shall exercise any such rights under this DPA, not separately for each Authorized Affiliate individually, but in a combined manner for itself and all of its Authorized Affiliates together (as set forth, for example, in Section 3.5.3.2, below); and

3.5.3.2 The parties agree that Customer (that is the contracting party to the Agreement) shall, when carrying out an On-Site Audit of the procedures relevant to the protection of Customer Personal Data, combine multiple audit requests carried out on behalf of itself and all of its Authorized Affiliates into one single audit.

3.6 Description of Processing. The subject-matter of processing of Customer Personal Data by WeWork is the performance of the Services pursuant to the Agreement and the obligations and rights of Customer are set out in the Agreement and this DPA. The duration of the processing, the nature and purpose of the processing, the categories of personal data and categories of data subjects processed under this DPA are as specified in Schedule 1 (Description of Processing)

3.7 Processing of Sensitive Data or Special Data Categories of Data. Any processing of Sensitive Data or Special Categories of Data is subject to mutual agreement of the parties and must be set forth in a separate written agreement between the parties.

3.8 Confidentiality. WeWork shall ensure that any person who is authorized by WeWork to process Customer Personal Data shall be subject to an appropriate obligation of confidentiality (whether contractual or statutory).

4. SUB-PROCESSING

4.1 Use of Sub-processors; Liability. Customer acknowledges and agrees that: (i) WeWork’s Affiliates may be retained as sub-processors and (ii) WeWork and WeWork’s Affiliates may engage third-party sub-processors for the purpose of providing the Services. WeWork or a WeWork Affiliate, as applicable, shall enter into a written agreement with each sub-processor containing, in substance, data protection obligations no less protective than those set forth in this DPA with respect to the processing of Customer Personal Data to the extent applicable to the nature of the services provided by such sub-processor. WeWork shall be liable for the acts and omissions of its sub-processors to the same extent WeWork would be liable if performing the services of each sub-processor directly under the terms of this DPA, unless otherwise set forth in the Agreement.

4.2 General Authorization; List of Current Sub-processors. Customer provides WeWork with a general authorization to engage sub-processors, subject to the terms of this Section 4. The current list of sub-processors and WeWork Affiliates engaged by WeWork to process Customer Personal Data are set out at https://www.weworkworkplace.com/legal/sub-processor-list (“Sub-processor Site”). A general description of each sub-processor’s processing activities and countries of location is listed on the Sub-processor Site.

4.3 Changes to Sub-processors. WeWork shall notify Customer of its intention to engage any new sub-processor to process Customer Personal Data in connection with the provision of applicable Services. Customer shall have fifteen (15) days from the date of such notification to reasonably object (based on reasonable grounds relating to data protection) to the engagement of any new sub-processor by providing written notice to WeWork (the “Objection Period”). If Customer objects to the engagement of a new sub-processor during the Objection Period, the parties shall discuss those objections in good faith with a view to achieving resolution. If it can be reasonably demonstrated to WeWork that the new sub-processor is unable to process Customer Personal Data in compliance with the terms of this DPA and WeWork cannot provide an alternative sub-processor, or the parties are not otherwise able to achieve resolution, Customer, as its sole and exclusive remedy, may terminate the portion of the Services for which the new sub-processor is engaged and receive a prorated refund of prepaid fees applicable to the terminated portion of the Services for the period after termination. If Customer fails to notify WeWork of its objection within the Objection Period, Customer shall be deemed to have approved the use of the new sub-processor.

4.4 Emergency Replacement. WeWork may replace a sub-processor without advance notification where the reason for the change is outside WeWork’s reasonable control and prompt replacement is required for security or other urgent reasons. In this case, WeWork shall inform Customer of the replacement sub-processor as soon as possible following its appointment. Following such notice, Customer shall have the right to reasonably object to the engagement of such sub-processor subject to process set forth in Section 4.3 above.

5. DATA SECURITY

5.1 Security Measures. WeWork shall implement and maintain appropriate technical and organizational measures designed to protect Customer Personal Data from Security Incidents. Such security measures are set out at https://www.weworkworkplace.com/legal/security-measures (“Security Measures”). WeWork may review and update its Security  Measures from time to time, provided that any such updates shall not materially diminish the overall security of the Services or Customer Personal Data.

5.2 No Assessment of Customer Personal Data by WeWork. WeWork shall have no obligation to assess the contents or accuracy of Customer Personal Data, including to identify information subject to any specific legal, regulatory, or other requirement. Customer is responsible for reviewing the information made available by WeWork relating to data security and making an independent determination as to whether the Services meet Customer’s requirements and legal obligations under Data Protection Law.

5.3 Demonstration of Compliance; Audit. WeWork shall make available to Customer information reasonably necessary to demonstrate compliance with its obligations under this DPA as set forth in this Section 5.3. Customer agrees that any audit rights granted by to Customer under Data Protection Law (including, where applicable, the exercise of audit the Standard Contractual Clauses) will be satisfied by the information and assistance set forth in this Section 5.3.

5.3.1 Third-Party Audits and Certifications. WeWork shall, upon Customer’s written request at reasonable intervals and subject to the confidentiality obligations set forth in the Agreement, make available to Customer (and/or Customer’s authorized third-party independent contractor that is not a competitor or WeWork (“Third-Party Auditor”) information evidencing WeWork’s compliance with its obligations under this DPA in the form of relevant third-party audits or certifications that are applicable to the Services (“Audit Reports”).

5.3.2 Customer Audit Rights. To the extent Data Protection Law provides Customer with a direct audit right with respect to the processing of Customer Data and: (i) the information made available pursuant to Section 5.3.1 (Third-Party Audits and Certifications) is not sufficient to demonstrate WeWork’s compliance with the obligations set out in this DPA or (ii) such an audit is required by Data Protection Law or by Customer’s competent supervisory authority, Customer may request an on-site audit of WeWork’s applicable controls covered by this DPA (“On-Site Audit”). After receipt by WeWork of such On-Site Audit request, the parties shall mutually agree in advance on the details of the On-site Audit, including the scope, timing and duration of the audit and, to the extent legally permitted, the reimbursement rate for which Customer shall be responsible (which shall be reasonable taking into account the resources expended by WeWork). An On-Site Audit shall be conducted by Customer or a Third-Party Auditor: (i) acting reasonably, in good faith, and in a proportionate manner, taking into account the nature and complexity of the Services used by Customer; (ii) no more than once annually with at least thirty (30) days’ advance written notice to WeWork; (iii) limited to Customer Data processing and facilities operated by WeWork and (iv) during WeWork’s normal business hours under reasonable duration and without interference with WeWork’s day-to-day operations. Where the On-Site Audit is conducted by a Third-Party Auditor, the Third-Party Auditor may be required to execute a confidentiality agreement with WeWork with provisions that are no less protective that those set forth on the Agreement, and the costs of the Third-Party Audit are at Customer’s expense. WeWork may object to a Third-Party Auditor, if in WeWork’s reasonable opinion, the Third-Party Auditor is not suitably qualified or is a direct competitor of WeWork. Customer and/or the Third-Party Auditor shall provide WeWork with the results and findings of the On-Site Audit (“Findings”), including any non-compliance discovered.

5.3.3 Audit Reports and Findings. The Audit Reports, any On-Site Audit and any information arising therefrom, including the Findings, shall be considered WeWork’s Confidential Information and may only be shared with a third-party (including a Third-Party Controller) with WeWork’s prior written agreement.

6. SECURITY INCIDENT NOTIFICATION AND MANAGEMENT. WeWork shall notify Customer without undue delay (and within any requisite time periods), as required by Data Protection Law, after becoming aware of a Security Incident and take appropriate steps to investigate and address the Security Incident, including measures to mitigate any adverse effects resulting from the Security Incident to the extent mitigation is within WeWork’s reasonable control. WeWork shall provide reasonable information in its possession to assist Customer to meet Customer’s obligation to report a Security Incident as required by Data Protection Law. Such notification or action by WeWork shall not be interpreted or construed as an admission of any fault or liability with respect to the Security Incident. The obligations herein shall not apply to incidents that are caused by Customer or Customer’s Authorized Users.

7. ASSISTANCE AND COOPERATION

7.1 Data Subject and Consumer Requests. WeWork shall, to the extent legally permitted, promptly notify Customer if WeWork receives a complaint, dispute or request from a data subject or consumer that identifies Customer Personal Data or otherwise identifies Customer, including a request to exercise any of its rights under Data Protection Law with respect to Customer Personal Data in connection with the Services (“Data Subject Requests”). Customer or the Third-Party Controller, as applicable, shall be solely responsible for responding to Data Subject Requests; provided, however, WeWork may confirm to the data subject or consumer that WeWork received the communication and redirect the request to Customer. To the extent Customer is unable to access the relevant Customer Personal Data within the Services, WeWork shall (upon Customer’s written instruction and to the extent required by Data Protection Law) provide Customer with commercially reasonable assistance to fulfill Customer’s obligations to respond to Data Subject Requests by appropriate and technical organizational measures, insofar as it is possible, taking into account the nature of the processing. To the extent legally permitted, Customer shall be responsible for any costs arising from WeWork’s provision of such assistance.

7.2 Data Protection Impact Assessments and Consultations.  To the extent Customer does not otherwise have access to the relevant information and to the extent such information is available to WeWork, WeWork shall provide reasonable assistance to Customer in connection with any data protection impact assessment or prior consultations with supervisory authorities as required by Data Protection Law to the extent such assistance is applicable to WeWork’s processing of Customer Personal Data in connection with the performance of the Services.

7.3 Government, Law Enforcement, and/or Third-Party Inquiries. If WeWork receives a demand to retain, disclose, or otherwise process Customer Personal Data for any third party, including, but not limited to law enforcement or a government authority (“Third-Party Demand”), then WeWork shall attempt to redirect the Third-Party Demand to Customer. Customer agrees that WeWork can provide information to such third-party as reasonably necessary to redirect the Third-Party Demand. If WeWork cannot redirect the Third-Party Demand to Customer, then WeWork shall, to the extent legally permitted to do so, provide Customer reasonable notice of the Third-Party Demand as promptly as feasible under the circumstances to allow Customer to seek a protective order or other appropriate remedy. This section does not diminish WeWork’s obligations under the SCCs with respect to access by public authorities.

8. RETURN OR DELETION OF CUSTOMER PERSONAL DATA. Upon termination or expiration of the Agreement, WeWork shall delete or return, except to the extent WeWork is required to retain such Customer Personal Data under applicable laws or document retention policies adopted in accordance with such laws; provided, however, the confidentiality and restricted use obligations set forth in the Agreement shall continue to apply to such Customer Personal Data for the duration of such retention.

9. CROSS-BORDER TRANSFERS

9.1 Customer Authorization. Subject to the terms of this DPA, Customer authorizes WeWork and WeWork’s Affiliates to transfer Customer Personal Data from Restricted Countries to Third Countries (both terms as defined below), provided that WeWork takes such measures as are necessary to ensure the transfer is in compliance with Data Protection Law. 

9.2 Transfers to WeWork [EEA, UK & Switzerland]. For any transfers by Customer of Customer Personal Data from the European Economic Area and its member states, United Kingdom and/or Switzerland (collectively, “Restricted Countries”) to WeWork in a country which does not ensure an adequate level of protection (within the meaning of and to the extent governed by the applicable Data Protection Law of the Restricted Countries) (“Third Country”), the parties agree to abide by and transfer Customer Personal Data from the Restricted Countries in accordance with the applicable  SCCs, which are incorporated into this DPA by reference. In the case of any transfers of Customer Personal Data subject to the UK GDPR or Data Protection Law of Switzerland (“Swiss Data Protection Law”), (i) general and specific references in the EU SCCs to GDPR or EU or Member State Law shall have the same meaning as the equivalent reference in the UK GDPR or Swiss Data Protection Law, as applicable and (ii) any other obligation in the EU SCCs determined by the Member State in which the data exporter or data subject is established shall refer to an obligation under the UK GDPR or Swiss Data Protection Law, as applicable. Each party is deemed to have executed the SCCs by entering into this DPA and such details shall apply for the purposes of Table 1 of the UK Addendum. The following shall apply to the SCCs, including the election of specific terms and/or optional clauses as described in more detail in 9.2.1-9.2.8 below, and any optional clauses not expressly selected are not incorporated (including with respect to Table 2 of the UK Addendum):

9.2.1 Modules. Where optional modules may be applied within the EU SCCs, (i) only those labeled “MODULE TWO: Transfer controller to processor” shall apply to the extent Customer is a controller and an exporter of Customer Personal Data and WeWork is a processor and data importer with respect to that Customer Personal Data and (ii) only those labeled “MODULE THREE: Transfer processor to processor” shall apply to the extent Customer is a processor acting on behalf of a Third-Party Controller and a data exporter of personal data and WeWork is a processor and data importer with respect to that Customer Personal Data. If and to the extent an Authorized Affiliate relies on the SCCs for the transfer of Customer Personal Data, any references to “Customer” in this Section shall include such Authorized Affiliate. The foregoing shall apply with respect to Table 2 of the UK Addendum.

9.2.2 Docking Clause. The option under Clause 7 shall not apply. The foregoing shall apply with respect to Table 2 of the UK Addendum. 

9.2.3 Use of Sub-processors. OPTION 2: GENERAL WRITTEN authorization under Clause 9 shall apply. For purposes of Clause 9(a), the process and time period for the addition or replacement of sub-processors shall be as described in Section 4 (Sub-processing) of this DPA. Where WeWork enters into the EU P-to-P SCCs with a sub-processor in connection with the provision of the Services, Customer hereby grants WeWork and WeWork’s Affiliates authority to provide a general authorization on Customer's behalf for the engagement of sub-processors by sub-processors engaged in the provision of the Services, as well as decision making and approval authority for the addition or replacement of any such sub-processors. The foregoing shall apply with respect to Table 2 of the UK Addendum.

9.2.4 Redress. The option under Clause 11 shall not apply. The foregoing shall apply with respect to Table 2 of the UK Addendum.

9.2.5 Supervision. For purposes of Clause 13 and Annex 1.C of the EU SCCs, Clause 13 shall apply as follows:

9.2.5.1 Where Customer is established in an EU Member State, the supervisory authority with responsibility for ensuring compliance by Customer with Regulation (EU) 2016/679 as regards the data transfer shall act as competent supervisory authority.

9.2.5.2 Where Customer is not established in an EU Member State, but falls within the territorial scope of application of Regulation (EU) 2016/679 in accordance with its Article 3(2) and has appointed a representative pursuant to Article 27(1) of Regulation (EU) 2016/679, the supervisory authority of the Member State in which the representative within the meaning of Article 27(1) of Regulation (EU) 2016/679 is established shall act as competent supervisory authority.

9.2.5.3 Where Customer is not established in an EU Member State, but falls within the territorial scope of application of Regulation (EU) 2016/679 in accordance with its Article 3(2) without however having to appoint a representative pursuant to Article 27(2) of Regulation (EU) 2016/679, the Data Protection Commission of Ireland (DPA) shall act as competent supervisory authority. 

9.2.5.4 Where Customer is established in the United Kingdom or falls within the territorial scope of application of the UK GDPR, the Information Commissioner's Office shall act as competent supervisory authority.

9.2.5.5 Where Customer is established in Switzerland or falls within the territorial scope of application of Swiss Data Protection Law, the Swiss Federal Data Protection and Information Commissioner shall act as competent supervisory authority insofar as the relevant data transfer is governed by Swiss Data Protection Law.

Customer shall maintain accurate records of the applicable Member State(s) and competent supervisory authority, which shall be made available to WeWork on request.

9.2.6 Governing Law, Choice of Forum and Jurisdiction. For purposes of Clause 17 and Clause 18 of the EU SCCs, the Member State for purposes of governing law and jurisdiction shall be Ireland. Part 2, Section 15(m) and Part 2, Section 15(n) of the UK Addendum regarding Clause 17 and Clause 18 of the EU SCCs shall apply.

9.2.7 Annexes. For purposes of execution of the EU SCCs, Schedule 1 (Description of Processing) shall be incorporated as ANNEX I; (ii) the technical and organizational measures described in Section 5.1 (Security Measures) shall be incorporated as ANNEX II; and (iii) the authorized list of Sub-processors set out on the Sub-processor Site shall be incorporated as ANNEX III. The foregoing shall apply with respect to Table 3 of the UK Addendum.

9.2.8 Table 4 of UK Addendum. With respect to Table 4 of the UK Addendum, either party may terminate the UK Addendum pursuant to Section 19 of the UK Addendum if, after a good faith effort by the parties to amend this DPA to account for the approved changes and any reasonable clarifications to the UK Addendum, the parties are unable to come to a mutual agreement.

9.3 Transfers to WeWork [Non-EEA, UK & Switzerland]. The parties shall execute any other version of a model contract or data transfer agreement to offer adequate data protection safeguards in relation to the transfer of Customer Personal Data as the parties deem reasonably necessary to comply with Data Protection Law.

9.4 Transfers to Sub-processors. To the extent any transfers of Customer Personal Data by WeWork to a sub-processor are subject to onward cross-border transfer restrictions under Data Protection Law, WeWork shall have in place appropriate data transfer solutions with such sub-processors or appropriate safeguards to provide adequate protection for such Customer Personal Data to ensure compliance with this DPA and Data Protection Law, which may include without limitation, the EU P-to-P SCCs.

10. LIMITATION OF LIABILITY. Notwithstanding anything to the contrary in the Agreement or this DPA, each party’s and all of its Affiliates’ liability, taken together in the aggregate, arising out of or related to this DPA, and all DPAs between Authorized Affiliates and WeWork, whether in contract, tort or under any other theory of liability, shall be subject to the ‘Limitation of Liability’ section of the Agreement, and any reference in such section to the liability of a party means the aggregate liability of that party and all of its Affiliates under the Agreement and all DPAs together. For the avoidance of doubt, WeWork’s and its Affiliates’ total liability for all claims from Customer and all of its Authorized Affiliates arising out of or related to the Agreement and all DPAs shall apply in the aggregate for all claims under both the Agreement and the DPAs established under the Agreement, including by Customer and all Authorized Affiliates, and, in particular, shall not be understood to apply individually and severally to Customer and/or to any Authorized Affiliate that is a contractual party to any such DPA.

11. MISCELLANEOUS.

11.1 Assistance Costs. To the extent legally permitted, Customer is responsible for the reasonable costs and fees associated with WeWork's provision of assistance under this DPA and implementation of any additional instructions outside the scope of the Agreement, an applicable ordering document or this DPA. The parties shall agree in advance on any reimbursement rate for which Customer shall be responsible (which shall be reasonable taking into account the resources expended by WeWork).

11.2 Choice of Law. Except with respect to the SCCs (which shall be subject to Section 9), this DPA is governed by the laws that govern the Agreement, and any dispute between the parties shall be handled as set forth in the Agreement.

11.3 Entire Agreement; Amendments and Modifications. This DPA, together with all exhibits, schedules, addenda, and appendices attached to this DPA and any other documents incorporated into this DPA by reference, constitutes the sole and entire agreement of the parties with respect to the subject matter of this DPA and supersedes all prior and contemporaneous understandings, agreements, and representations and warranties, both written and oral, with respect to such subject matter. Except as expressly provided in this DPA, the terms of the Agreement are and shall remain in full force and effect. WeWork may update this DPA from time to time with such updated version posted to www.weworkworkplace.com/legal/data-processing-addendum or a successor website designated by WeWork; provided, however, that no such update shall materially diminish the privacy or security of Customer Personal Data.